From c7bcde2d275b16e928b2a0e882265e3e7572b054 Mon Sep 17 00:00:00 2001 From: TrueCharts-Bot Date: Tue, 21 Dec 2021 18:46:27 +0000 Subject: [PATCH] Commit released Helm Chart and docs for TrueCharts Signed-off-by: TrueCharts-Bot --- charts/core/k8s-gateway/CHANGELOG.md | 9 + charts/core/k8s-gateway/README.md | 2 +- charts/core/k8s-gateway/security.md | 7 +- charts/core/prometheus/CHANGELOG.md | 10 + charts/core/prometheus/README.md | 2 +- charts/core/prometheus/helm-values.md | 4 +- charts/core/prometheus/security.md | 21 +- charts/core/traefik/CHANGELOG.md | 9 + charts/core/traefik/README.md | 2 +- charts/core/traefik/security.md | 10 +- .../incubator/omada-controller/CHANGELOG.md | 9 + charts/incubator/omada-controller/README.md | 2 +- charts/incubator/omada-controller/security.md | 6 +- charts/incubator/tdarr-node/CHANGELOG.md | 9 + charts/incubator/tdarr-node/README.md | 2 +- charts/incubator/tdarr-node/security.md | 4 - charts/incubator/tdarr/CHANGELOG.md | 9 + charts/incubator/tdarr/README.md | 2 +- charts/incubator/tdarr/security.md | 4 - charts/stable/airsonic/CHANGELOG.md | 9 + charts/stable/airsonic/README.md | 2 +- charts/stable/airsonic/security.md | 4 - charts/stable/amcrest2mqtt/CHANGELOG.md | 9 + charts/stable/amcrest2mqtt/README.md | 2 +- charts/stable/amcrest2mqtt/security.md | 5 +- charts/stable/anonaddy/CHANGELOG.md | 9 + charts/stable/anonaddy/README.md | 6 +- charts/stable/anonaddy/security.md | 20 +- charts/stable/apache-musicindex/CHANGELOG.md | 9 + charts/stable/apache-musicindex/README.md | 2 +- charts/stable/apache-musicindex/security.md | 16 +- charts/stable/appdaemon/CHANGELOG.md | 9 + charts/stable/appdaemon/README.md | 2 +- charts/stable/appdaemon/security.md | 4 - charts/stable/aria2/CHANGELOG.md | 9 + charts/stable/aria2/README.md | 2 +- charts/stable/aria2/security.md | 4 - charts/stable/audacity/CHANGELOG.md | 9 + charts/stable/audacity/README.md | 2 +- charts/stable/audacity/security.md | 4 - charts/stable/authelia/CHANGELOG.md | 9 + charts/stable/authelia/README.md | 6 +- charts/stable/authelia/security.md | 27 +- charts/stable/babybuddy/CHANGELOG.md | 9 + charts/stable/babybuddy/README.md | 4 +- charts/stable/babybuddy/security.md | 18 +- charts/stable/bazarr/CHANGELOG.md | 9 + charts/stable/bazarr/README.md | 2 +- charts/stable/bazarr/security.md | 9 +- charts/stable/beets/CHANGELOG.md | 9 + charts/stable/beets/README.md | 2 +- charts/stable/beets/security.md | 4 - charts/stable/blog/CHANGELOG.md | 9 + charts/stable/blog/README.md | 4 +- charts/stable/blog/security.md | 40 +- charts/stable/boinc/CHANGELOG.md | 9 + charts/stable/boinc/README.md | 2 +- charts/stable/boinc/security.md | 4 +- charts/stable/booksonic-air/CHANGELOG.md | 9 + charts/stable/booksonic-air/README.md | 2 +- charts/stable/booksonic-air/security.md | 8 +- charts/stable/bookstack/CHANGELOG.md | 9 + charts/stable/bookstack/README.md | 4 +- charts/stable/bookstack/security.md | 14 +- charts/stable/calibre-web/CHANGELOG.md | 9 + charts/stable/calibre-web/README.md | 2 +- charts/stable/calibre-web/security.md | 4 - charts/stable/calibre/CHANGELOG.md | 9 + charts/stable/calibre/README.md | 2 +- charts/stable/calibre/security.md | 5 +- charts/stable/chevereto/CHANGELOG.md | 9 + charts/stable/chevereto/README.md | 4 +- charts/stable/chevereto/security.md | 11 +- charts/stable/clarkson/CHANGELOG.md | 9 + charts/stable/clarkson/README.md | 4 +- charts/stable/clarkson/security.md | 12 +- charts/stable/cloud9/CHANGELOG.md | 9 + charts/stable/cloud9/README.md | 2 +- charts/stable/cloud9/security.md | 5 +- charts/stable/code-server/CHANGELOG.md | 9 + charts/stable/code-server/README.md | 2 +- charts/stable/code-server/security.md | 13 +- charts/stable/collabora-online/CHANGELOG.md | 9 + charts/stable/collabora-online/README.md | 2 +- charts/stable/collabora-online/security.md | 4 - charts/stable/couchpotato/CHANGELOG.md | 9 + charts/stable/couchpotato/README.md | 2 +- charts/stable/couchpotato/security.md | 3 - charts/stable/cryptofolio/CHANGELOG.md | 9 + charts/stable/cryptofolio/README.md | 2 +- charts/stable/cryptofolio/security.md | 28 +- charts/stable/custom-app/CHANGELOG.md | 10 + charts/stable/custom-app/README.md | 2 +- charts/stable/custom-app/helm-values.md | 2 +- charts/stable/custom-app/security.md | 13 +- charts/stable/darktable/CHANGELOG.md | 9 + charts/stable/darktable/README.md | 2 +- charts/stable/darktable/security.md | 17 +- charts/stable/davos/CHANGELOG.md | 9 + charts/stable/davos/README.md | 2 +- charts/stable/davos/security.md | 14 +- charts/stable/ddclient/CHANGELOG.md | 9 + charts/stable/ddclient/README.md | 2 +- charts/stable/ddclient/security.md | 3 - charts/stable/deconz/CHANGELOG.md | 9 + charts/stable/deconz/README.md | 2 +- charts/stable/deconz/security.md | 4 - charts/stable/deepstack-cpu/CHANGELOG.md | 9 + charts/stable/deepstack-cpu/README.md | 2 +- charts/stable/deepstack-cpu/security.md | 28 +- charts/stable/deepstack-gpu/CHANGELOG.md | 9 + charts/stable/deepstack-gpu/README.md | 2 +- charts/stable/deepstack-gpu/security.md | 28 +- charts/stable/deluge/CHANGELOG.md | 9 + charts/stable/deluge/README.md | 2 +- charts/stable/deluge/security.md | 4 - charts/stable/digikam/CHANGELOG.md | 9 + charts/stable/digikam/README.md | 2 +- charts/stable/digikam/security.md | 5 +- charts/stable/dillinger/CHANGELOG.md | 9 + charts/stable/dillinger/README.md | 2 +- charts/stable/dillinger/security.md | 3 - charts/stable/dizquetv/CHANGELOG.md | 9 + charts/stable/dizquetv/README.md | 2 +- charts/stable/dizquetv/security.md | 5 +- charts/stable/dokuwiki/CHANGELOG.md | 9 + charts/stable/dokuwiki/README.md | 2 +- charts/stable/dokuwiki/security.md | 3 - charts/stable/domoticz/CHANGELOG.md | 9 + charts/stable/domoticz/README.md | 2 +- charts/stable/domoticz/security.md | 3 - charts/stable/doublecommander/CHANGELOG.md | 9 + charts/stable/doublecommander/README.md | 2 +- charts/stable/doublecommander/security.md | 5 +- charts/stable/dsmr-reader/CHANGELOG.md | 9 + charts/stable/dsmr-reader/README.md | 4 +- charts/stable/dsmr-reader/security.md | 18 +- charts/stable/duckdns/CHANGELOG.md | 9 + charts/stable/duckdns/README.md | 2 +- charts/stable/duckdns/security.md | 3 - charts/stable/duplicati/CHANGELOG.md | 9 + charts/stable/duplicati/README.md | 2 +- charts/stable/duplicati/security.md | 5 +- charts/stable/emby/CHANGELOG.md | 9 + charts/stable/emby/README.md | 2 +- charts/stable/emby/security.md | 9 +- charts/stable/embystat/CHANGELOG.md | 9 + charts/stable/embystat/README.md | 2 +- charts/stable/embystat/security.md | 3 - charts/stable/emulatorjs/CHANGELOG.md | 9 + charts/stable/emulatorjs/README.md | 2 +- charts/stable/emulatorjs/security.md | 8 +- charts/stable/endlessh/CHANGELOG.md | 9 + charts/stable/endlessh/README.md | 2 +- charts/stable/endlessh/security.md | 3 - charts/stable/esphome/CHANGELOG.md | 9 + charts/stable/esphome/README.md | 2 +- charts/stable/esphome/security.md | 5 +- charts/stable/etherpad/CHANGELOG.md | 9 + charts/stable/etherpad/README.md | 4 +- charts/stable/etherpad/security.md | 18 +- charts/stable/external-service/CHANGELOG.md | 9 + charts/stable/external-service/README.md | 2 +- charts/stable/filezilla/CHANGELOG.md | 9 + charts/stable/filezilla/README.md | 2 +- charts/stable/filezilla/security.md | 4 - charts/stable/fireflyiii/CHANGELOG.md | 9 + charts/stable/fireflyiii/README.md | 6 +- charts/stable/fireflyiii/security.md | 50 +- charts/stable/firefox-syncserver/CHANGELOG.md | 9 + charts/stable/firefox-syncserver/README.md | 4 +- charts/stable/firefox-syncserver/security.md | 18 +- charts/stable/firefox/CHANGELOG.md | 9 + charts/stable/firefox/README.md | 2 +- charts/stable/firefox/security.md | 17 +- charts/stable/flaresolverr/CHANGELOG.md | 9 + charts/stable/flaresolverr/README.md | 2 +- charts/stable/flaresolverr/security.md | 4 - charts/stable/fleet/CHANGELOG.md | 9 + charts/stable/fleet/README.md | 4 +- charts/stable/fleet/security.md | 15 +- charts/stable/flood/CHANGELOG.md | 9 + charts/stable/flood/README.md | 2 +- charts/stable/flood/security.md | 5 +- charts/stable/focalboard/CHANGELOG.md | 9 + charts/stable/focalboard/README.md | 2 +- charts/stable/focalboard/security.md | 6 +- charts/stable/foldingathome/CHANGELOG.md | 9 + charts/stable/foldingathome/README.md | 2 +- charts/stable/foldingathome/security.md | 3 - charts/stable/fossil/CHANGELOG.md | 9 + charts/stable/fossil/README.md | 2 +- charts/stable/fossil/security.md | 4 - charts/stable/freeradius/CHANGELOG.md | 9 + charts/stable/freeradius/README.md | 2 +- charts/stable/freeradius/security.md | 4 - charts/stable/freshrss/CHANGELOG.md | 9 + charts/stable/freshrss/README.md | 2 +- charts/stable/freshrss/security.md | 4 - charts/stable/friendica/CHANGELOG.md | 9 + charts/stable/friendica/README.md | 6 +- charts/stable/friendica/security.md | 42 +- charts/stable/gaps/CHANGELOG.md | 9 + charts/stable/gaps/README.md | 2 +- charts/stable/gaps/security.md | 9 +- charts/stable/gitea/CHANGELOG.md | 9 + charts/stable/gitea/README.md | 6 +- charts/stable/gitea/security.md | 39 +- charts/stable/golinks/CHANGELOG.md | 9 + charts/stable/golinks/README.md | 2 +- charts/stable/golinks/security.md | 4 - charts/stable/gonic/CHANGELOG.md | 9 + charts/stable/gonic/README.md | 2 +- charts/stable/gonic/security.md | 10 +- charts/stable/gotify/CHANGELOG.md | 9 + charts/stable/gotify/README.md | 4 +- charts/stable/gotify/security.md | 28 +- charts/stable/grafana/CHANGELOG.md | 10 + charts/stable/grafana/README.md | 2 +- charts/stable/grafana/helm-values.md | 2 +- charts/stable/grafana/security.md | 9 +- charts/stable/grav/CHANGELOG.md | 9 + charts/stable/grav/README.md | 2 +- charts/stable/grav/security.md | 4 - charts/stable/grocy/CHANGELOG.md | 9 + charts/stable/grocy/README.md | 2 +- charts/stable/grocy/security.md | 6 +- charts/stable/guacd/CHANGELOG.md | 9 + charts/stable/guacd/README.md | 2 +- charts/stable/guacd/security.md | 3 - charts/stable/habridge/CHANGELOG.md | 9 + charts/stable/habridge/README.md | 2 +- charts/stable/habridge/security.md | 3 - charts/stable/handbrake/CHANGELOG.md | 9 + charts/stable/handbrake/README.md | 2 +- charts/stable/handbrake/security.md | 4 - charts/stable/haste-server/CHANGELOG.md | 9 + charts/stable/haste-server/README.md | 2 +- charts/stable/haste-server/security.md | 9 +- charts/stable/headphones/CHANGELOG.md | 9 + charts/stable/headphones/README.md | 2 +- charts/stable/headphones/security.md | 4 - charts/stable/healthchecks/CHANGELOG.md | 9 + charts/stable/healthchecks/README.md | 2 +- charts/stable/healthchecks/security.md | 4 - charts/stable/hedgedoc/CHANGELOG.md | 9 + charts/stable/hedgedoc/README.md | 4 +- charts/stable/hedgedoc/security.md | 11 +- charts/stable/heimdall/CHANGELOG.md | 9 + charts/stable/heimdall/README.md | 2 +- charts/stable/heimdall/security.md | 4 - charts/stable/home-assistant/CHANGELOG.md | 9 + charts/stable/home-assistant/README.md | 4 +- charts/stable/home-assistant/security.md | 20 +- charts/stable/htpcmanager/CHANGELOG.md | 9 + charts/stable/htpcmanager/README.md | 2 +- charts/stable/htpcmanager/security.md | 3 - charts/stable/hyperion-ng/CHANGELOG.md | 9 + charts/stable/hyperion-ng/README.md | 2 +- charts/stable/hyperion-ng/security.md | 18 +- .../icantbelieveitsnotvaletudo/CHANGELOG.md | 9 + .../icantbelieveitsnotvaletudo/README.md | 2 +- .../icantbelieveitsnotvaletudo/security.md | 5 +- charts/stable/icinga2/CHANGELOG.md | 9 + charts/stable/icinga2/README.md | 4 +- charts/stable/icinga2/security.md | 20 +- charts/stable/ipfs/CHANGELOG.md | 9 + charts/stable/ipfs/README.md | 2 +- charts/stable/ipfs/security.md | 4 +- charts/stable/jackett/CHANGELOG.md | 10 + charts/stable/jackett/README.md | 2 +- charts/stable/jackett/helm-values.md | 2 +- charts/stable/jackett/security.md | 13 +- charts/stable/jdownloader2/CHANGELOG.md | 9 + charts/stable/jdownloader2/README.md | 2 +- charts/stable/jdownloader2/security.md | 4 - charts/stable/jellyfin/CHANGELOG.md | 9 + charts/stable/jellyfin/README.md | 2 +- charts/stable/jellyfin/security.md | 5 +- charts/stable/joplin-server/CHANGELOG.md | 9 + charts/stable/joplin-server/README.md | 4 +- charts/stable/joplin-server/security.md | 34 +- charts/stable/kanboard/CHANGELOG.md | 9 + charts/stable/kanboard/README.md | 4 +- charts/stable/kanboard/security.md | 18 +- charts/stable/kms/CHANGELOG.md | 9 + charts/stable/kms/README.md | 2 +- charts/stable/kms/security.md | 4 - charts/stable/kodi-headless/CHANGELOG.md | 9 + charts/stable/kodi-headless/README.md | 2 +- charts/stable/kodi-headless/security.md | 3 - charts/stable/komga/CHANGELOG.md | 9 + charts/stable/komga/README.md | 2 +- charts/stable/komga/security.md | 9 +- charts/stable/lazylibrarian/CHANGELOG.md | 9 + charts/stable/lazylibrarian/README.md | 2 +- charts/stable/lazylibrarian/security.md | 4 - charts/stable/leaf2mqtt/CHANGELOG.md | 9 + charts/stable/leaf2mqtt/README.md | 2 +- charts/stable/leaf2mqtt/security.md | 4 - charts/stable/leantime/CHANGELOG.md | 9 + charts/stable/leantime/README.md | 4 +- charts/stable/leantime/security.md | 12 +- charts/stable/libreoffice/CHANGELOG.md | 9 + charts/stable/libreoffice/README.md | 2 +- charts/stable/libreoffice/security.md | 17 +- charts/stable/librespeed/CHANGELOG.md | 9 + charts/stable/librespeed/README.md | 2 +- charts/stable/librespeed/security.md | 4 - charts/stable/lidarr/CHANGELOG.md | 10 + charts/stable/lidarr/README.md | 2 +- charts/stable/lidarr/helm-values.md | 2 +- charts/stable/lidarr/security.md | 13 +- charts/stable/littlelink/CHANGELOG.md | 9 + charts/stable/littlelink/README.md | 2 +- charts/stable/littlelink/security.md | 5 +- .../stable/logitech-media-server/CHANGELOG.md | 9 + charts/stable/logitech-media-server/README.md | 2 +- .../stable/logitech-media-server/security.md | 4 - charts/stable/loki/CHANGELOG.md | 9 + charts/stable/loki/README.md | 4 +- charts/stable/loki/security.md | 9 +- charts/stable/lychee/CHANGELOG.md | 9 + charts/stable/lychee/README.md | 2 +- charts/stable/lychee/security.md | 6 +- charts/stable/mealie/CHANGELOG.md | 9 + charts/stable/mealie/README.md | 4 +- charts/stable/mealie/security.md | 18 +- charts/stable/medusa/CHANGELOG.md | 9 + charts/stable/medusa/README.md | 2 +- charts/stable/medusa/security.md | 4 - charts/stable/minetest/CHANGELOG.md | 9 + charts/stable/minetest/README.md | 2 +- charts/stable/minetest/security.md | 3 - charts/stable/miniflux/CHANGELOG.md | 9 + charts/stable/miniflux/README.md | 4 +- charts/stable/miniflux/security.md | 20 +- charts/stable/minio-console/CHANGELOG.md | 9 + charts/stable/minio-console/README.md | 2 +- charts/stable/minio-console/security.md | 10 +- charts/stable/minio/CHANGELOG.md | 9 + charts/stable/minio/README.md | 2 +- charts/stable/minio/security.md | 5 +- charts/stable/minisatip/CHANGELOG.md | 9 + charts/stable/minisatip/README.md | 2 +- charts/stable/minisatip/security.md | 3 - charts/stable/monica/CHANGELOG.md | 9 + charts/stable/monica/README.md | 4 +- charts/stable/monica/security.md | 36 +- charts/stable/mosquitto/CHANGELOG.md | 9 + charts/stable/mosquitto/README.md | 2 +- charts/stable/mosquitto/security.md | 5 +- charts/stable/mstream/CHANGELOG.md | 9 + charts/stable/mstream/README.md | 2 +- charts/stable/mstream/security.md | 4 - charts/stable/muximux/CHANGELOG.md | 9 + charts/stable/muximux/README.md | 2 +- charts/stable/muximux/security.md | 4 - charts/stable/mylar/CHANGELOG.md | 9 + charts/stable/mylar/README.md | 2 +- charts/stable/mylar/security.md | 4 - charts/stable/mysql-workbench/CHANGELOG.md | 9 + charts/stable/mysql-workbench/README.md | 2 +- charts/stable/mysql-workbench/security.md | 4 +- charts/stable/nano-wallet/CHANGELOG.md | 9 + charts/stable/nano-wallet/README.md | 2 +- charts/stable/nano-wallet/security.md | 3 - charts/stable/navidrome/CHANGELOG.md | 9 + charts/stable/navidrome/README.md | 2 +- charts/stable/navidrome/security.md | 10 +- charts/stable/nextcloud/CHANGELOG.md | 9 + charts/stable/nextcloud/README.md | 6 +- charts/stable/nextcloud/security.md | 72 +- charts/stable/ngircd/CHANGELOG.md | 9 + charts/stable/ngircd/README.md | 2 +- charts/stable/ngircd/security.md | 3 - charts/stable/nntp2nntp/CHANGELOG.md | 9 + charts/stable/nntp2nntp/README.md | 2 +- charts/stable/nntp2nntp/security.md | 3 - charts/stable/node-red/CHANGELOG.md | 9 + charts/stable/node-red/README.md | 2 +- charts/stable/node-red/security.md | 5 +- charts/stable/novnc/CHANGELOG.md | 9 + charts/stable/novnc/README.md | 2 +- charts/stable/novnc/security.md | 4 - charts/stable/nullserv/CHANGELOG.md | 9 + charts/stable/nullserv/README.md | 2 +- charts/stable/nullserv/security.md | 4 - charts/stable/nzbget/CHANGELOG.md | 10 + charts/stable/nzbget/README.md | 2 +- charts/stable/nzbget/helm-values.md | 2 +- charts/stable/nzbget/security.md | 43 +- charts/stable/nzbhydra/CHANGELOG.md | 10 + charts/stable/nzbhydra/README.md | 2 +- charts/stable/nzbhydra/helm-values.md | 2 +- charts/stable/nzbhydra/security.md | 51 +- charts/stable/octoprint/CHANGELOG.md | 9 + charts/stable/octoprint/README.md | 2 +- charts/stable/octoprint/security.md | 18 +- charts/stable/odoo/CHANGELOG.md | 9 + charts/stable/odoo/README.md | 4 +- charts/stable/odoo/security.md | 19 +- charts/stable/ombi/CHANGELOG.md | 9 + charts/stable/ombi/README.md | 2 +- charts/stable/ombi/security.md | 9 +- .../onlyoffice-document-server/CHANGELOG.md | 9 + .../onlyoffice-document-server/README.md | 2 +- .../onlyoffice-document-server/security.md | 4 - charts/stable/openkm/CHANGELOG.md | 9 + charts/stable/openkm/README.md | 4 +- charts/stable/openkm/security.md | 20 +- charts/stable/openldap/CHANGELOG.md | 9 + charts/stable/openldap/README.md | 2 +- charts/stable/openldap/security.md | 6 +- charts/stable/openvscode-server/CHANGELOG.md | 9 + charts/stable/openvscode-server/README.md | 2 +- charts/stable/openvscode-server/security.md | 3 - charts/stable/organizr/CHANGELOG.md | 9 + charts/stable/organizr/README.md | 2 +- charts/stable/organizr/security.md | 6 +- charts/stable/oscam/CHANGELOG.md | 9 + charts/stable/oscam/README.md | 2 +- charts/stable/oscam/security.md | 5 +- charts/stable/overseerr/CHANGELOG.md | 9 + charts/stable/overseerr/README.md | 2 +- charts/stable/overseerr/security.md | 5 +- charts/stable/owncast/CHANGELOG.md | 9 + charts/stable/owncast/README.md | 2 +- charts/stable/owncast/security.md | 4 - charts/stable/owncloud-ocis/CHANGELOG.md | 9 + charts/stable/owncloud-ocis/README.md | 2 +- charts/stable/owncloud-ocis/security.md | 7 +- charts/stable/paperless-ng/CHANGELOG.md | 13 + charts/stable/paperless-ng/README.md | 6 +- charts/stable/paperless-ng/helm-values.md | 10 +- charts/stable/paperless-ng/security.md | 42 +- charts/stable/papermerge/CHANGELOG.md | 9 + charts/stable/papermerge/README.md | 4 +- charts/stable/papermerge/security.md | 11 +- charts/stable/pgadmin/CHANGELOG.md | 9 + charts/stable/pgadmin/README.md | 2 +- charts/stable/pgadmin/security.md | 4 - charts/stable/photoprism/CHANGELOG.md | 9 + charts/stable/photoprism/README.md | 4 +- charts/stable/photoprism/security.md | 15 +- charts/stable/photoshow/CHANGELOG.md | 9 + charts/stable/photoshow/README.md | 2 +- charts/stable/photoshow/security.md | 4 - charts/stable/phpldapadmin/CHANGELOG.md | 9 + charts/stable/phpldapadmin/README.md | 2 +- charts/stable/phpldapadmin/security.md | 12 +- charts/stable/piaware/CHANGELOG.md | 9 + charts/stable/piaware/README.md | 2 +- charts/stable/piaware/security.md | 4 - charts/stable/pidgin/CHANGELOG.md | 9 + charts/stable/pidgin/README.md | 2 +- charts/stable/pidgin/security.md | 17 +- charts/stable/pihole/CHANGELOG.md | 9 + charts/stable/pihole/README.md | 2 +- charts/stable/pihole/security.md | 4 - charts/stable/piwigo/CHANGELOG.md | 9 + charts/stable/piwigo/README.md | 2 +- charts/stable/piwigo/security.md | 4 - charts/stable/pixapop/CHANGELOG.md | 9 + charts/stable/pixapop/README.md | 2 +- charts/stable/pixapop/security.md | 18 +- charts/stable/plex/CHANGELOG.md | 9 + charts/stable/plex/README.md | 2 +- charts/stable/plex/security.md | 9 +- charts/stable/podgrab/CHANGELOG.md | 9 + charts/stable/podgrab/README.md | 2 +- charts/stable/podgrab/security.md | 8 +- .../stable/pretend-youre-xyzzy/CHANGELOG.md | 9 + charts/stable/pretend-youre-xyzzy/README.md | 2 +- charts/stable/pretend-youre-xyzzy/security.md | 4 - charts/stable/projectsend/CHANGELOG.md | 9 + charts/stable/projectsend/README.md | 2 +- charts/stable/projectsend/security.md | 3 - charts/stable/promcord/CHANGELOG.md | 9 + charts/stable/promcord/README.md | 2 +- charts/stable/promcord/security.md | 5 +- charts/stable/protonmail-bridge/CHANGELOG.md | 9 + charts/stable/protonmail-bridge/README.md | 2 +- charts/stable/protonmail-bridge/security.md | 16 +- charts/stable/prowlarr/CHANGELOG.md | 10 + charts/stable/prowlarr/README.md | 2 +- charts/stable/prowlarr/helm-values.md | 2 +- charts/stable/prowlarr/security.md | 37 +- charts/stable/pwndrop/CHANGELOG.md | 9 + charts/stable/pwndrop/README.md | 2 +- charts/stable/pwndrop/security.md | 8 +- charts/stable/pydio-cells/CHANGELOG.md | 9 + charts/stable/pydio-cells/README.md | 2 +- charts/stable/pydio-cells/security.md | 3 - charts/stable/pyload/CHANGELOG.md | 9 + charts/stable/pyload/README.md | 2 +- charts/stable/pyload/security.md | 4 - charts/stable/pylon/CHANGELOG.md | 9 + charts/stable/pylon/README.md | 2 +- charts/stable/pylon/security.md | 3 - charts/stable/qbittorrent/CHANGELOG.md | 10 + charts/stable/qbittorrent/README.md | 2 +- charts/stable/qbittorrent/helm-values.md | 2 +- charts/stable/qbittorrent/security.md | 38 +- charts/stable/quassel-core/CHANGELOG.md | 9 + charts/stable/quassel-core/README.md | 4 +- charts/stable/quassel-core/security.md | 17 +- charts/stable/quassel-web/CHANGELOG.md | 9 + charts/stable/quassel-web/README.md | 2 +- charts/stable/quassel-web/security.md | 3 - charts/stable/radarr/CHANGELOG.md | 10 + charts/stable/radarr/README.md | 2 +- charts/stable/radarr/helm-values.md | 2 +- charts/stable/radarr/security.md | 37 +- charts/stable/readarr/CHANGELOG.md | 10 + charts/stable/readarr/README.md | 2 +- charts/stable/readarr/helm-values.md | 2 +- charts/stable/readarr/security.md | 13 +- charts/stable/recipes/CHANGELOG.md | 9 + charts/stable/recipes/README.md | 4 +- charts/stable/recipes/security.md | 20 +- charts/stable/reg/CHANGELOG.md | 9 + charts/stable/reg/README.md | 2 +- charts/stable/reg/security.md | 5 +- charts/stable/remmina/CHANGELOG.md | 9 + charts/stable/remmina/README.md | 2 +- charts/stable/remmina/security.md | 5 +- charts/stable/requestrr/CHANGELOG.md | 9 + charts/stable/requestrr/README.md | 2 +- charts/stable/requestrr/security.md | 3 - charts/stable/resilio-sync/CHANGELOG.md | 9 + charts/stable/resilio-sync/README.md | 2 +- charts/stable/rsnapshot/CHANGELOG.md | 9 + charts/stable/rsnapshot/README.md | 2 +- charts/stable/rsnapshot/security.md | 3 - charts/stable/sabnzbd/CHANGELOG.md | 10 + charts/stable/sabnzbd/README.md | 2 +- charts/stable/sabnzbd/helm-values.md | 2 +- charts/stable/sabnzbd/security.md | 34 +- charts/stable/scrutiny/CHANGELOG.md | 9 + charts/stable/scrutiny/README.md | 2 +- charts/stable/scrutiny/security.md | 6 +- charts/stable/ser2sock/CHANGELOG.md | 9 + charts/stable/ser2sock/README.md | 2 +- charts/stable/shiori/CHANGELOG.md | 9 + charts/stable/shiori/README.md | 4 +- charts/stable/shiori/security.md | 19 +- charts/stable/shorturl/CHANGELOG.md | 9 + charts/stable/shorturl/README.md | 2 +- charts/stable/shorturl/security.md | 4 - charts/stable/sickchill/CHANGELOG.md | 9 + charts/stable/sickchill/README.md | 2 +- charts/stable/sickchill/security.md | 4 - charts/stable/sickgear/CHANGELOG.md | 9 + charts/stable/sickgear/README.md | 2 +- charts/stable/sickgear/security.md | 4 - charts/stable/smokeping/CHANGELOG.md | 9 + charts/stable/smokeping/README.md | 2 +- charts/stable/smokeping/security.md | 4 - charts/stable/snipe-it/CHANGELOG.md | 9 + charts/stable/snipe-it/README.md | 4 +- charts/stable/snipe-it/security.md | 16 +- charts/stable/sonarr/CHANGELOG.md | 10 + charts/stable/sonarr/README.md | 2 +- charts/stable/sonarr/helm-values.md | 2 +- charts/stable/sonarr/security.md | 13 +- charts/stable/speedtest-exporter/CHANGELOG.md | 9 + charts/stable/speedtest-exporter/README.md | 2 +- charts/stable/speedtest-exporter/security.md | 4 +- charts/stable/sqlitebrowser/CHANGELOG.md | 9 + charts/stable/sqlitebrowser/README.md | 2 +- charts/stable/sqlitebrowser/security.md | 5 +- charts/stable/stash/CHANGELOG.md | 9 + charts/stable/stash/README.md | 2 +- charts/stable/stash/security.md | 9 +- charts/stable/static/CHANGELOG.md | 9 + charts/stable/static/README.md | 2 +- charts/stable/static/security.md | 4 - charts/stable/statping/CHANGELOG.md | 9 + charts/stable/statping/README.md | 4 +- charts/stable/statping/security.md | 20 +- charts/stable/synclounge/CHANGELOG.md | 9 + charts/stable/synclounge/README.md | 2 +- charts/stable/synclounge/security.md | 3 - charts/stable/syncthing/CHANGELOG.md | 9 + charts/stable/syncthing/README.md | 2 +- charts/stable/syncthing/security.md | 5 +- charts/stable/syslog-ng/CHANGELOG.md | 9 + charts/stable/syslog-ng/README.md | 2 +- charts/stable/syslog-ng/security.md | 3 - charts/stable/tautulli/CHANGELOG.md | 10 + charts/stable/tautulli/README.md | 2 +- charts/stable/tautulli/helm-values.md | 2 +- charts/stable/tautulli/security.md | 18 +- charts/stable/teamspeak3/CHANGELOG.md | 9 + charts/stable/teamspeak3/README.md | 2 +- charts/stable/teamspeak3/security.md | 4 - charts/stable/teedy/CHANGELOG.md | 9 + charts/stable/teedy/README.md | 4 +- charts/stable/teedy/security.md | 23 +- charts/stable/thelounge/CHANGELOG.md | 9 + charts/stable/thelounge/README.md | 2 +- charts/stable/thelounge/security.md | 18 +- charts/stable/traccar/CHANGELOG.md | 9 + charts/stable/traccar/README.md | 4 +- charts/stable/traccar/security.md | 19 +- charts/stable/transmission/CHANGELOG.md | 9 + charts/stable/transmission/README.md | 2 +- charts/stable/transmission/security.md | 9 +- charts/stable/truecommand/CHANGELOG.md | 9 + charts/stable/truecommand/README.md | 2 +- charts/stable/truecommand/security.md | 17 +- charts/stable/tt-rss/CHANGELOG.md | 9 + charts/stable/tt-rss/README.md | 4 +- charts/stable/tt-rss/security.md | 22 +- charts/stable/tvheadend/CHANGELOG.md | 9 + charts/stable/tvheadend/README.md | 2 +- charts/stable/tvheadend/security.md | 4 - charts/stable/twtxt/CHANGELOG.md | 9 + charts/stable/twtxt/README.md | 2 +- charts/stable/twtxt/security.md | 5 +- charts/stable/ubooquity/CHANGELOG.md | 9 + charts/stable/ubooquity/README.md | 2 +- charts/stable/ubooquity/security.md | 3 - charts/stable/unifi/CHANGELOG.md | 9 + charts/stable/unifi/README.md | 2 +- charts/stable/unifi/security.md | 6 +- charts/stable/unpackerr/CHANGELOG.md | 9 + charts/stable/unpackerr/README.md | 2 +- charts/stable/unpackerr/security.md | 5 +- charts/stable/unpoller/CHANGELOG.md | 9 + charts/stable/unpoller/README.md | 2 +- charts/stable/unpoller/security.md | 5 +- charts/stable/uptime-kuma/CHANGELOG.md | 9 + charts/stable/uptime-kuma/README.md | 2 +- charts/stable/uptime-kuma/security.md | 4 - .../uptimerobot-prometheus/CHANGELOG.md | 9 + .../stable/uptimerobot-prometheus/README.md | 2 +- .../stable/uptimerobot-prometheus/security.md | 5 +- charts/stable/valheim/CHANGELOG.md | 9 + charts/stable/valheim/README.md | 2 +- charts/stable/valheim/security.md | 18 +- charts/stable/vaultwarden/CHANGELOG.md | 9 + charts/stable/vaultwarden/README.md | 4 +- charts/stable/vaultwarden/security.md | 33 +- charts/stable/webgrabplus/CHANGELOG.md | 9 + charts/stable/webgrabplus/README.md | 2 +- charts/stable/webgrabplus/security.md | 3 - charts/stable/whoogle/CHANGELOG.md | 9 + charts/stable/whoogle/README.md | 2 +- charts/stable/whoogle/security.md | 4 - charts/stable/wikijs/CHANGELOG.md | 9 + charts/stable/wikijs/README.md | 4 +- charts/stable/wikijs/security.md | 18 +- charts/stable/wireshark/CHANGELOG.md | 9 + charts/stable/wireshark/README.md | 2 +- charts/stable/wireshark/security.md | 4 +- charts/stable/xbackbone/CHANGELOG.md | 9 + charts/stable/xbackbone/README.md | 4 +- charts/stable/xbackbone/security.md | 12 +- charts/stable/xteve/CHANGELOG.md | 9 + charts/stable/xteve/README.md | 2 +- charts/stable/xteve/security.md | 9 +- charts/stable/zigbee2mqtt/CHANGELOG.md | 9 + charts/stable/zigbee2mqtt/README.md | 2 +- charts/stable/zigbee2mqtt/security.md | 5 +- charts/stable/znc/CHANGELOG.md | 9 + charts/stable/znc/README.md | 2 +- charts/stable/znc/security.md | 3 - charts/stable/zwavejs2mqtt/CHANGELOG.md | 9 + charts/stable/zwavejs2mqtt/README.md | 2 +- charts/stable/zwavejs2mqtt/security.md | 5 +- docs/apps/core/k8s-gateway/CHANGELOG.md | 9 + docs/apps/core/k8s-gateway/index.md | 2 +- docs/apps/core/k8s-gateway/security.md | 7 +- docs/apps/core/prometheus/CHANGELOG.md | 10 + docs/apps/core/prometheus/helm-values.md | 4 +- docs/apps/core/prometheus/index.md | 2 +- docs/apps/core/prometheus/security.md | 21 +- docs/apps/core/traefik/CHANGELOG.md | 9 + docs/apps/core/traefik/index.md | 2 +- docs/apps/core/traefik/security.md | 10 +- .../incubator/omada-controller/CHANGELOG.md | 9 + docs/apps/incubator/omada-controller/index.md | 2 +- .../incubator/omada-controller/security.md | 6 +- docs/apps/incubator/tdarr-node/CHANGELOG.md | 9 + docs/apps/incubator/tdarr-node/index.md | 2 +- docs/apps/incubator/tdarr-node/security.md | 4 - docs/apps/incubator/tdarr/CHANGELOG.md | 9 + docs/apps/incubator/tdarr/index.md | 2 +- docs/apps/incubator/tdarr/security.md | 4 - docs/apps/stable/airsonic/CHANGELOG.md | 9 + docs/apps/stable/airsonic/index.md | 2 +- docs/apps/stable/airsonic/security.md | 4 - docs/apps/stable/amcrest2mqtt/CHANGELOG.md | 9 + docs/apps/stable/amcrest2mqtt/index.md | 2 +- docs/apps/stable/amcrest2mqtt/security.md | 5 +- docs/apps/stable/anonaddy/CHANGELOG.md | 9 + docs/apps/stable/anonaddy/index.md | 6 +- docs/apps/stable/anonaddy/security.md | 20 +- .../stable/apache-musicindex/CHANGELOG.md | 9 + docs/apps/stable/apache-musicindex/index.md | 2 +- .../apps/stable/apache-musicindex/security.md | 16 +- docs/apps/stable/appdaemon/CHANGELOG.md | 9 + docs/apps/stable/appdaemon/index.md | 2 +- docs/apps/stable/appdaemon/security.md | 4 - docs/apps/stable/aria2/CHANGELOG.md | 9 + docs/apps/stable/aria2/index.md | 2 +- docs/apps/stable/aria2/security.md | 4 - docs/apps/stable/audacity/CHANGELOG.md | 9 + docs/apps/stable/audacity/index.md | 2 +- docs/apps/stable/audacity/security.md | 4 - docs/apps/stable/authelia/CHANGELOG.md | 9 + docs/apps/stable/authelia/index.md | 6 +- docs/apps/stable/authelia/security.md | 27 +- docs/apps/stable/babybuddy/CHANGELOG.md | 9 + docs/apps/stable/babybuddy/index.md | 4 +- docs/apps/stable/babybuddy/security.md | 18 +- docs/apps/stable/bazarr/CHANGELOG.md | 9 + docs/apps/stable/bazarr/index.md | 2 +- docs/apps/stable/bazarr/security.md | 9 +- docs/apps/stable/beets/CHANGELOG.md | 9 + docs/apps/stable/beets/index.md | 2 +- docs/apps/stable/beets/security.md | 4 - docs/apps/stable/blog/CHANGELOG.md | 9 + docs/apps/stable/blog/index.md | 4 +- docs/apps/stable/blog/security.md | 40 +- docs/apps/stable/boinc/CHANGELOG.md | 9 + docs/apps/stable/boinc/index.md | 2 +- docs/apps/stable/boinc/security.md | 4 +- docs/apps/stable/booksonic-air/CHANGELOG.md | 9 + docs/apps/stable/booksonic-air/index.md | 2 +- docs/apps/stable/booksonic-air/security.md | 8 +- docs/apps/stable/bookstack/CHANGELOG.md | 9 + docs/apps/stable/bookstack/index.md | 4 +- docs/apps/stable/bookstack/security.md | 14 +- docs/apps/stable/calibre-web/CHANGELOG.md | 9 + docs/apps/stable/calibre-web/index.md | 2 +- docs/apps/stable/calibre-web/security.md | 4 - docs/apps/stable/calibre/CHANGELOG.md | 9 + docs/apps/stable/calibre/index.md | 2 +- docs/apps/stable/calibre/security.md | 5 +- docs/apps/stable/chevereto/CHANGELOG.md | 9 + docs/apps/stable/chevereto/index.md | 4 +- docs/apps/stable/chevereto/security.md | 11 +- docs/apps/stable/clarkson/CHANGELOG.md | 9 + docs/apps/stable/clarkson/index.md | 4 +- docs/apps/stable/clarkson/security.md | 12 +- docs/apps/stable/cloud9/CHANGELOG.md | 9 + docs/apps/stable/cloud9/index.md | 2 +- docs/apps/stable/cloud9/security.md | 5 +- docs/apps/stable/code-server/CHANGELOG.md | 9 + docs/apps/stable/code-server/index.md | 2 +- docs/apps/stable/code-server/security.md | 13 +- .../apps/stable/collabora-online/CHANGELOG.md | 9 + docs/apps/stable/collabora-online/index.md | 2 +- docs/apps/stable/collabora-online/security.md | 4 - docs/apps/stable/couchpotato/CHANGELOG.md | 9 + docs/apps/stable/couchpotato/index.md | 2 +- docs/apps/stable/couchpotato/security.md | 3 - docs/apps/stable/cryptofolio/CHANGELOG.md | 9 + docs/apps/stable/cryptofolio/index.md | 2 +- docs/apps/stable/cryptofolio/security.md | 28 +- docs/apps/stable/custom-app/CHANGELOG.md | 10 + docs/apps/stable/custom-app/helm-values.md | 2 +- docs/apps/stable/custom-app/index.md | 2 +- docs/apps/stable/custom-app/security.md | 13 +- docs/apps/stable/darktable/CHANGELOG.md | 9 + docs/apps/stable/darktable/index.md | 2 +- docs/apps/stable/darktable/security.md | 17 +- docs/apps/stable/davos/CHANGELOG.md | 9 + docs/apps/stable/davos/index.md | 2 +- docs/apps/stable/davos/security.md | 14 +- docs/apps/stable/ddclient/CHANGELOG.md | 9 + docs/apps/stable/ddclient/index.md | 2 +- docs/apps/stable/ddclient/security.md | 3 - docs/apps/stable/deconz/CHANGELOG.md | 9 + docs/apps/stable/deconz/index.md | 2 +- docs/apps/stable/deconz/security.md | 4 - docs/apps/stable/deepstack-cpu/CHANGELOG.md | 9 + docs/apps/stable/deepstack-cpu/index.md | 2 +- docs/apps/stable/deepstack-cpu/security.md | 28 +- docs/apps/stable/deepstack-gpu/CHANGELOG.md | 9 + docs/apps/stable/deepstack-gpu/index.md | 2 +- docs/apps/stable/deepstack-gpu/security.md | 28 +- docs/apps/stable/deluge/CHANGELOG.md | 9 + docs/apps/stable/deluge/index.md | 2 +- docs/apps/stable/deluge/security.md | 4 - docs/apps/stable/digikam/CHANGELOG.md | 9 + docs/apps/stable/digikam/index.md | 2 +- docs/apps/stable/digikam/security.md | 5 +- docs/apps/stable/dillinger/CHANGELOG.md | 9 + docs/apps/stable/dillinger/index.md | 2 +- docs/apps/stable/dillinger/security.md | 3 - docs/apps/stable/dizquetv/CHANGELOG.md | 9 + docs/apps/stable/dizquetv/index.md | 2 +- docs/apps/stable/dizquetv/security.md | 5 +- docs/apps/stable/dokuwiki/CHANGELOG.md | 9 + docs/apps/stable/dokuwiki/index.md | 2 +- docs/apps/stable/dokuwiki/security.md | 3 - docs/apps/stable/domoticz/CHANGELOG.md | 9 + docs/apps/stable/domoticz/index.md | 2 +- docs/apps/stable/domoticz/security.md | 3 - docs/apps/stable/doublecommander/CHANGELOG.md | 9 + docs/apps/stable/doublecommander/index.md | 2 +- docs/apps/stable/doublecommander/security.md | 5 +- docs/apps/stable/dsmr-reader/CHANGELOG.md | 9 + docs/apps/stable/dsmr-reader/index.md | 4 +- docs/apps/stable/dsmr-reader/security.md | 18 +- docs/apps/stable/duckdns/CHANGELOG.md | 9 + docs/apps/stable/duckdns/index.md | 2 +- docs/apps/stable/duckdns/security.md | 3 - docs/apps/stable/duplicati/CHANGELOG.md | 9 + docs/apps/stable/duplicati/index.md | 2 +- docs/apps/stable/duplicati/security.md | 5 +- docs/apps/stable/emby/CHANGELOG.md | 9 + docs/apps/stable/emby/index.md | 2 +- docs/apps/stable/emby/security.md | 9 +- docs/apps/stable/embystat/CHANGELOG.md | 9 + docs/apps/stable/embystat/index.md | 2 +- docs/apps/stable/embystat/security.md | 3 - docs/apps/stable/emulatorjs/CHANGELOG.md | 9 + docs/apps/stable/emulatorjs/index.md | 2 +- docs/apps/stable/emulatorjs/security.md | 8 +- docs/apps/stable/endlessh/CHANGELOG.md | 9 + docs/apps/stable/endlessh/index.md | 2 +- docs/apps/stable/endlessh/security.md | 3 - docs/apps/stable/esphome/CHANGELOG.md | 9 + docs/apps/stable/esphome/index.md | 2 +- docs/apps/stable/esphome/security.md | 5 +- docs/apps/stable/etherpad/CHANGELOG.md | 9 + docs/apps/stable/etherpad/index.md | 4 +- docs/apps/stable/etherpad/security.md | 18 +- .../apps/stable/external-service/CHANGELOG.md | 9 + docs/apps/stable/external-service/index.md | 2 +- docs/apps/stable/filezilla/CHANGELOG.md | 9 + docs/apps/stable/filezilla/index.md | 2 +- docs/apps/stable/filezilla/security.md | 4 - docs/apps/stable/fireflyiii/CHANGELOG.md | 9 + docs/apps/stable/fireflyiii/index.md | 6 +- docs/apps/stable/fireflyiii/security.md | 50 +- .../stable/firefox-syncserver/CHANGELOG.md | 9 + docs/apps/stable/firefox-syncserver/index.md | 4 +- .../stable/firefox-syncserver/security.md | 18 +- docs/apps/stable/firefox/CHANGELOG.md | 9 + docs/apps/stable/firefox/index.md | 2 +- docs/apps/stable/firefox/security.md | 17 +- docs/apps/stable/flaresolverr/CHANGELOG.md | 9 + docs/apps/stable/flaresolverr/index.md | 2 +- docs/apps/stable/flaresolverr/security.md | 4 - docs/apps/stable/fleet/CHANGELOG.md | 9 + docs/apps/stable/fleet/index.md | 4 +- docs/apps/stable/fleet/security.md | 15 +- docs/apps/stable/flood/CHANGELOG.md | 9 + docs/apps/stable/flood/index.md | 2 +- docs/apps/stable/flood/security.md | 5 +- docs/apps/stable/focalboard/CHANGELOG.md | 9 + docs/apps/stable/focalboard/index.md | 2 +- docs/apps/stable/focalboard/security.md | 6 +- docs/apps/stable/foldingathome/CHANGELOG.md | 9 + docs/apps/stable/foldingathome/index.md | 2 +- docs/apps/stable/foldingathome/security.md | 3 - docs/apps/stable/fossil/CHANGELOG.md | 9 + docs/apps/stable/fossil/index.md | 2 +- docs/apps/stable/fossil/security.md | 4 - docs/apps/stable/freeradius/CHANGELOG.md | 9 + docs/apps/stable/freeradius/index.md | 2 +- docs/apps/stable/freeradius/security.md | 4 - docs/apps/stable/freshrss/CHANGELOG.md | 9 + docs/apps/stable/freshrss/index.md | 2 +- docs/apps/stable/freshrss/security.md | 4 - docs/apps/stable/friendica/CHANGELOG.md | 9 + docs/apps/stable/friendica/index.md | 6 +- docs/apps/stable/friendica/security.md | 42 +- docs/apps/stable/gaps/CHANGELOG.md | 9 + docs/apps/stable/gaps/index.md | 2 +- docs/apps/stable/gaps/security.md | 9 +- docs/apps/stable/gitea/CHANGELOG.md | 9 + docs/apps/stable/gitea/index.md | 6 +- docs/apps/stable/gitea/security.md | 39 +- docs/apps/stable/golinks/CHANGELOG.md | 9 + docs/apps/stable/golinks/index.md | 2 +- docs/apps/stable/golinks/security.md | 4 - docs/apps/stable/gonic/CHANGELOG.md | 9 + docs/apps/stable/gonic/index.md | 2 +- docs/apps/stable/gonic/security.md | 10 +- docs/apps/stable/gotify/CHANGELOG.md | 9 + docs/apps/stable/gotify/index.md | 4 +- docs/apps/stable/gotify/security.md | 28 +- docs/apps/stable/grafana/CHANGELOG.md | 10 + docs/apps/stable/grafana/helm-values.md | 2 +- docs/apps/stable/grafana/index.md | 2 +- docs/apps/stable/grafana/security.md | 9 +- docs/apps/stable/grav/CHANGELOG.md | 9 + docs/apps/stable/grav/index.md | 2 +- docs/apps/stable/grav/security.md | 4 - docs/apps/stable/grocy/CHANGELOG.md | 9 + docs/apps/stable/grocy/index.md | 2 +- docs/apps/stable/grocy/security.md | 6 +- docs/apps/stable/guacd/CHANGELOG.md | 9 + docs/apps/stable/guacd/index.md | 2 +- docs/apps/stable/guacd/security.md | 3 - docs/apps/stable/habridge/CHANGELOG.md | 9 + docs/apps/stable/habridge/index.md | 2 +- docs/apps/stable/habridge/security.md | 3 - docs/apps/stable/handbrake/CHANGELOG.md | 9 + docs/apps/stable/handbrake/index.md | 2 +- docs/apps/stable/handbrake/security.md | 4 - docs/apps/stable/haste-server/CHANGELOG.md | 9 + docs/apps/stable/haste-server/index.md | 2 +- docs/apps/stable/haste-server/security.md | 9 +- docs/apps/stable/headphones/CHANGELOG.md | 9 + docs/apps/stable/headphones/index.md | 2 +- docs/apps/stable/headphones/security.md | 4 - docs/apps/stable/healthchecks/CHANGELOG.md | 9 + docs/apps/stable/healthchecks/index.md | 2 +- docs/apps/stable/healthchecks/security.md | 4 - docs/apps/stable/hedgedoc/CHANGELOG.md | 9 + docs/apps/stable/hedgedoc/index.md | 4 +- docs/apps/stable/hedgedoc/security.md | 11 +- docs/apps/stable/heimdall/CHANGELOG.md | 9 + docs/apps/stable/heimdall/index.md | 2 +- docs/apps/stable/heimdall/security.md | 4 - docs/apps/stable/home-assistant/CHANGELOG.md | 9 + docs/apps/stable/home-assistant/index.md | 4 +- docs/apps/stable/home-assistant/security.md | 20 +- docs/apps/stable/htpcmanager/CHANGELOG.md | 9 + docs/apps/stable/htpcmanager/index.md | 2 +- docs/apps/stable/htpcmanager/security.md | 3 - docs/apps/stable/hyperion-ng/CHANGELOG.md | 9 + docs/apps/stable/hyperion-ng/index.md | 2 +- docs/apps/stable/hyperion-ng/security.md | 18 +- .../icantbelieveitsnotvaletudo/CHANGELOG.md | 9 + .../icantbelieveitsnotvaletudo/index.md | 2 +- .../icantbelieveitsnotvaletudo/security.md | 5 +- docs/apps/stable/icinga2/CHANGELOG.md | 9 + docs/apps/stable/icinga2/index.md | 4 +- docs/apps/stable/icinga2/security.md | 20 +- docs/apps/stable/ipfs/CHANGELOG.md | 9 + docs/apps/stable/ipfs/index.md | 2 +- docs/apps/stable/ipfs/security.md | 4 +- docs/apps/stable/jackett/CHANGELOG.md | 10 + docs/apps/stable/jackett/helm-values.md | 2 +- docs/apps/stable/jackett/index.md | 2 +- docs/apps/stable/jackett/security.md | 13 +- docs/apps/stable/jdownloader2/CHANGELOG.md | 9 + docs/apps/stable/jdownloader2/index.md | 2 +- docs/apps/stable/jdownloader2/security.md | 4 - docs/apps/stable/jellyfin/CHANGELOG.md | 9 + docs/apps/stable/jellyfin/index.md | 2 +- docs/apps/stable/jellyfin/security.md | 5 +- docs/apps/stable/joplin-server/CHANGELOG.md | 9 + docs/apps/stable/joplin-server/index.md | 4 +- docs/apps/stable/joplin-server/security.md | 34 +- docs/apps/stable/kanboard/CHANGELOG.md | 9 + docs/apps/stable/kanboard/index.md | 4 +- docs/apps/stable/kanboard/security.md | 18 +- docs/apps/stable/kms/CHANGELOG.md | 9 + docs/apps/stable/kms/index.md | 2 +- docs/apps/stable/kms/security.md | 4 - docs/apps/stable/kodi-headless/CHANGELOG.md | 9 + docs/apps/stable/kodi-headless/index.md | 2 +- docs/apps/stable/kodi-headless/security.md | 3 - docs/apps/stable/komga/CHANGELOG.md | 9 + docs/apps/stable/komga/index.md | 2 +- docs/apps/stable/komga/security.md | 9 +- docs/apps/stable/lazylibrarian/CHANGELOG.md | 9 + docs/apps/stable/lazylibrarian/index.md | 2 +- docs/apps/stable/lazylibrarian/security.md | 4 - docs/apps/stable/leaf2mqtt/CHANGELOG.md | 9 + docs/apps/stable/leaf2mqtt/index.md | 2 +- docs/apps/stable/leaf2mqtt/security.md | 4 - docs/apps/stable/leantime/CHANGELOG.md | 9 + docs/apps/stable/leantime/index.md | 4 +- docs/apps/stable/leantime/security.md | 12 +- docs/apps/stable/libreoffice/CHANGELOG.md | 9 + docs/apps/stable/libreoffice/index.md | 2 +- docs/apps/stable/libreoffice/security.md | 17 +- docs/apps/stable/librespeed/CHANGELOG.md | 9 + docs/apps/stable/librespeed/index.md | 2 +- docs/apps/stable/librespeed/security.md | 4 - docs/apps/stable/lidarr/CHANGELOG.md | 10 + docs/apps/stable/lidarr/helm-values.md | 2 +- docs/apps/stable/lidarr/index.md | 2 +- docs/apps/stable/lidarr/security.md | 13 +- docs/apps/stable/littlelink/CHANGELOG.md | 9 + docs/apps/stable/littlelink/index.md | 2 +- docs/apps/stable/littlelink/security.md | 5 +- .../stable/logitech-media-server/CHANGELOG.md | 9 + .../stable/logitech-media-server/index.md | 2 +- .../stable/logitech-media-server/security.md | 4 - docs/apps/stable/loki/CHANGELOG.md | 9 + docs/apps/stable/loki/index.md | 4 +- docs/apps/stable/loki/security.md | 9 +- docs/apps/stable/lychee/CHANGELOG.md | 9 + docs/apps/stable/lychee/index.md | 2 +- docs/apps/stable/lychee/security.md | 6 +- docs/apps/stable/mealie/CHANGELOG.md | 9 + docs/apps/stable/mealie/index.md | 4 +- docs/apps/stable/mealie/security.md | 18 +- docs/apps/stable/medusa/CHANGELOG.md | 9 + docs/apps/stable/medusa/index.md | 2 +- docs/apps/stable/medusa/security.md | 4 - docs/apps/stable/minetest/CHANGELOG.md | 9 + docs/apps/stable/minetest/index.md | 2 +- docs/apps/stable/minetest/security.md | 3 - docs/apps/stable/miniflux/CHANGELOG.md | 9 + docs/apps/stable/miniflux/index.md | 4 +- docs/apps/stable/miniflux/security.md | 20 +- docs/apps/stable/minio-console/CHANGELOG.md | 9 + docs/apps/stable/minio-console/index.md | 2 +- docs/apps/stable/minio-console/security.md | 10 +- docs/apps/stable/minio/CHANGELOG.md | 9 + docs/apps/stable/minio/index.md | 2 +- docs/apps/stable/minio/security.md | 5 +- docs/apps/stable/minisatip/CHANGELOG.md | 9 + docs/apps/stable/minisatip/index.md | 2 +- docs/apps/stable/minisatip/security.md | 3 - docs/apps/stable/monica/CHANGELOG.md | 9 + docs/apps/stable/monica/index.md | 4 +- docs/apps/stable/monica/security.md | 36 +- docs/apps/stable/mosquitto/CHANGELOG.md | 9 + docs/apps/stable/mosquitto/index.md | 2 +- docs/apps/stable/mosquitto/security.md | 5 +- docs/apps/stable/mstream/CHANGELOG.md | 9 + docs/apps/stable/mstream/index.md | 2 +- docs/apps/stable/mstream/security.md | 4 - docs/apps/stable/muximux/CHANGELOG.md | 9 + docs/apps/stable/muximux/index.md | 2 +- docs/apps/stable/muximux/security.md | 4 - docs/apps/stable/mylar/CHANGELOG.md | 9 + docs/apps/stable/mylar/index.md | 2 +- docs/apps/stable/mylar/security.md | 4 - docs/apps/stable/mysql-workbench/CHANGELOG.md | 9 + docs/apps/stable/mysql-workbench/index.md | 2 +- docs/apps/stable/mysql-workbench/security.md | 4 +- docs/apps/stable/nano-wallet/CHANGELOG.md | 9 + docs/apps/stable/nano-wallet/index.md | 2 +- docs/apps/stable/nano-wallet/security.md | 3 - docs/apps/stable/navidrome/CHANGELOG.md | 9 + docs/apps/stable/navidrome/index.md | 2 +- docs/apps/stable/navidrome/security.md | 10 +- docs/apps/stable/nextcloud/CHANGELOG.md | 9 + docs/apps/stable/nextcloud/index.md | 6 +- docs/apps/stable/nextcloud/security.md | 72 +- docs/apps/stable/ngircd/CHANGELOG.md | 9 + docs/apps/stable/ngircd/index.md | 2 +- docs/apps/stable/ngircd/security.md | 3 - docs/apps/stable/nntp2nntp/CHANGELOG.md | 9 + docs/apps/stable/nntp2nntp/index.md | 2 +- docs/apps/stable/nntp2nntp/security.md | 3 - docs/apps/stable/node-red/CHANGELOG.md | 9 + docs/apps/stable/node-red/index.md | 2 +- docs/apps/stable/node-red/security.md | 5 +- docs/apps/stable/novnc/CHANGELOG.md | 9 + docs/apps/stable/novnc/index.md | 2 +- docs/apps/stable/novnc/security.md | 4 - docs/apps/stable/nullserv/CHANGELOG.md | 9 + docs/apps/stable/nullserv/index.md | 2 +- docs/apps/stable/nullserv/security.md | 4 - docs/apps/stable/nzbget/CHANGELOG.md | 10 + docs/apps/stable/nzbget/helm-values.md | 2 +- docs/apps/stable/nzbget/index.md | 2 +- docs/apps/stable/nzbget/security.md | 43 +- docs/apps/stable/nzbhydra/CHANGELOG.md | 10 + docs/apps/stable/nzbhydra/helm-values.md | 2 +- docs/apps/stable/nzbhydra/index.md | 2 +- docs/apps/stable/nzbhydra/security.md | 51 +- docs/apps/stable/octoprint/CHANGELOG.md | 9 + docs/apps/stable/octoprint/index.md | 2 +- docs/apps/stable/octoprint/security.md | 18 +- docs/apps/stable/odoo/CHANGELOG.md | 9 + docs/apps/stable/odoo/index.md | 4 +- docs/apps/stable/odoo/security.md | 19 +- docs/apps/stable/ombi/CHANGELOG.md | 9 + docs/apps/stable/ombi/index.md | 2 +- docs/apps/stable/ombi/security.md | 9 +- .../onlyoffice-document-server/CHANGELOG.md | 9 + .../onlyoffice-document-server/index.md | 2 +- .../onlyoffice-document-server/security.md | 4 - docs/apps/stable/openkm/CHANGELOG.md | 9 + docs/apps/stable/openkm/index.md | 4 +- docs/apps/stable/openkm/security.md | 20 +- docs/apps/stable/openldap/CHANGELOG.md | 9 + docs/apps/stable/openldap/index.md | 2 +- docs/apps/stable/openldap/security.md | 6 +- .../stable/openvscode-server/CHANGELOG.md | 9 + docs/apps/stable/openvscode-server/index.md | 2 +- .../apps/stable/openvscode-server/security.md | 3 - docs/apps/stable/organizr/CHANGELOG.md | 9 + docs/apps/stable/organizr/index.md | 2 +- docs/apps/stable/organizr/security.md | 6 +- docs/apps/stable/oscam/CHANGELOG.md | 9 + docs/apps/stable/oscam/index.md | 2 +- docs/apps/stable/oscam/security.md | 5 +- docs/apps/stable/overseerr/CHANGELOG.md | 9 + docs/apps/stable/overseerr/index.md | 2 +- docs/apps/stable/overseerr/security.md | 5 +- docs/apps/stable/owncast/CHANGELOG.md | 9 + docs/apps/stable/owncast/index.md | 2 +- docs/apps/stable/owncast/security.md | 4 - docs/apps/stable/owncloud-ocis/CHANGELOG.md | 9 + docs/apps/stable/owncloud-ocis/index.md | 2 +- docs/apps/stable/owncloud-ocis/security.md | 7 +- docs/apps/stable/paperless-ng/CHANGELOG.md | 13 + docs/apps/stable/paperless-ng/helm-values.md | 10 +- docs/apps/stable/paperless-ng/index.md | 6 +- docs/apps/stable/paperless-ng/security.md | 42 +- docs/apps/stable/papermerge/CHANGELOG.md | 9 + docs/apps/stable/papermerge/index.md | 4 +- docs/apps/stable/papermerge/security.md | 11 +- docs/apps/stable/pgadmin/CHANGELOG.md | 9 + docs/apps/stable/pgadmin/index.md | 2 +- docs/apps/stable/pgadmin/security.md | 4 - docs/apps/stable/photoprism/CHANGELOG.md | 9 + docs/apps/stable/photoprism/index.md | 4 +- docs/apps/stable/photoprism/security.md | 15 +- docs/apps/stable/photoshow/CHANGELOG.md | 9 + docs/apps/stable/photoshow/index.md | 2 +- docs/apps/stable/photoshow/security.md | 4 - docs/apps/stable/phpldapadmin/CHANGELOG.md | 9 + docs/apps/stable/phpldapadmin/index.md | 2 +- docs/apps/stable/phpldapadmin/security.md | 12 +- docs/apps/stable/piaware/CHANGELOG.md | 9 + docs/apps/stable/piaware/index.md | 2 +- docs/apps/stable/piaware/security.md | 4 - docs/apps/stable/pidgin/CHANGELOG.md | 9 + docs/apps/stable/pidgin/index.md | 2 +- docs/apps/stable/pidgin/security.md | 17 +- docs/apps/stable/pihole/CHANGELOG.md | 9 + docs/apps/stable/pihole/index.md | 2 +- docs/apps/stable/pihole/security.md | 4 - docs/apps/stable/piwigo/CHANGELOG.md | 9 + docs/apps/stable/piwigo/index.md | 2 +- docs/apps/stable/piwigo/security.md | 4 - docs/apps/stable/pixapop/CHANGELOG.md | 9 + docs/apps/stable/pixapop/index.md | 2 +- docs/apps/stable/pixapop/security.md | 18 +- docs/apps/stable/plex/CHANGELOG.md | 9 + docs/apps/stable/plex/index.md | 2 +- docs/apps/stable/plex/security.md | 9 +- docs/apps/stable/podgrab/CHANGELOG.md | 9 + docs/apps/stable/podgrab/index.md | 2 +- docs/apps/stable/podgrab/security.md | 8 +- .../stable/pretend-youre-xyzzy/CHANGELOG.md | 9 + docs/apps/stable/pretend-youre-xyzzy/index.md | 2 +- .../stable/pretend-youre-xyzzy/security.md | 4 - docs/apps/stable/projectsend/CHANGELOG.md | 9 + docs/apps/stable/projectsend/index.md | 2 +- docs/apps/stable/projectsend/security.md | 3 - docs/apps/stable/promcord/CHANGELOG.md | 9 + docs/apps/stable/promcord/index.md | 2 +- docs/apps/stable/promcord/security.md | 5 +- .../stable/protonmail-bridge/CHANGELOG.md | 9 + docs/apps/stable/protonmail-bridge/index.md | 2 +- .../apps/stable/protonmail-bridge/security.md | 16 +- docs/apps/stable/prowlarr/CHANGELOG.md | 10 + docs/apps/stable/prowlarr/helm-values.md | 2 +- docs/apps/stable/prowlarr/index.md | 2 +- docs/apps/stable/prowlarr/security.md | 37 +- docs/apps/stable/pwndrop/CHANGELOG.md | 9 + docs/apps/stable/pwndrop/index.md | 2 +- docs/apps/stable/pwndrop/security.md | 8 +- docs/apps/stable/pydio-cells/CHANGELOG.md | 9 + docs/apps/stable/pydio-cells/index.md | 2 +- docs/apps/stable/pydio-cells/security.md | 3 - docs/apps/stable/pyload/CHANGELOG.md | 9 + docs/apps/stable/pyload/index.md | 2 +- docs/apps/stable/pyload/security.md | 4 - docs/apps/stable/pylon/CHANGELOG.md | 9 + docs/apps/stable/pylon/index.md | 2 +- docs/apps/stable/pylon/security.md | 3 - docs/apps/stable/qbittorrent/CHANGELOG.md | 10 + docs/apps/stable/qbittorrent/helm-values.md | 2 +- docs/apps/stable/qbittorrent/index.md | 2 +- docs/apps/stable/qbittorrent/security.md | 38 +- docs/apps/stable/quassel-core/CHANGELOG.md | 9 + docs/apps/stable/quassel-core/index.md | 4 +- docs/apps/stable/quassel-core/security.md | 17 +- docs/apps/stable/quassel-web/CHANGELOG.md | 9 + docs/apps/stable/quassel-web/index.md | 2 +- docs/apps/stable/quassel-web/security.md | 3 - docs/apps/stable/radarr/CHANGELOG.md | 10 + docs/apps/stable/radarr/helm-values.md | 2 +- docs/apps/stable/radarr/index.md | 2 +- docs/apps/stable/radarr/security.md | 37 +- docs/apps/stable/readarr/CHANGELOG.md | 10 + docs/apps/stable/readarr/helm-values.md | 2 +- docs/apps/stable/readarr/index.md | 2 +- docs/apps/stable/readarr/security.md | 13 +- docs/apps/stable/recipes/CHANGELOG.md | 9 + docs/apps/stable/recipes/index.md | 4 +- docs/apps/stable/recipes/security.md | 20 +- docs/apps/stable/reg/CHANGELOG.md | 9 + docs/apps/stable/reg/index.md | 2 +- docs/apps/stable/reg/security.md | 5 +- docs/apps/stable/remmina/CHANGELOG.md | 9 + docs/apps/stable/remmina/index.md | 2 +- docs/apps/stable/remmina/security.md | 5 +- docs/apps/stable/requestrr/CHANGELOG.md | 9 + docs/apps/stable/requestrr/index.md | 2 +- docs/apps/stable/requestrr/security.md | 3 - docs/apps/stable/resilio-sync/CHANGELOG.md | 9 + docs/apps/stable/resilio-sync/index.md | 2 +- docs/apps/stable/rsnapshot/CHANGELOG.md | 9 + docs/apps/stable/rsnapshot/index.md | 2 +- docs/apps/stable/rsnapshot/security.md | 3 - docs/apps/stable/sabnzbd/CHANGELOG.md | 10 + docs/apps/stable/sabnzbd/helm-values.md | 2 +- docs/apps/stable/sabnzbd/index.md | 2 +- docs/apps/stable/sabnzbd/security.md | 34 +- docs/apps/stable/scrutiny/CHANGELOG.md | 9 + docs/apps/stable/scrutiny/index.md | 2 +- docs/apps/stable/scrutiny/security.md | 6 +- docs/apps/stable/ser2sock/CHANGELOG.md | 9 + docs/apps/stable/ser2sock/index.md | 2 +- docs/apps/stable/shiori/CHANGELOG.md | 9 + docs/apps/stable/shiori/index.md | 4 +- docs/apps/stable/shiori/security.md | 19 +- docs/apps/stable/shorturl/CHANGELOG.md | 9 + docs/apps/stable/shorturl/index.md | 2 +- docs/apps/stable/shorturl/security.md | 4 - docs/apps/stable/sickchill/CHANGELOG.md | 9 + docs/apps/stable/sickchill/index.md | 2 +- docs/apps/stable/sickchill/security.md | 4 - docs/apps/stable/sickgear/CHANGELOG.md | 9 + docs/apps/stable/sickgear/index.md | 2 +- docs/apps/stable/sickgear/security.md | 4 - docs/apps/stable/smokeping/CHANGELOG.md | 9 + docs/apps/stable/smokeping/index.md | 2 +- docs/apps/stable/smokeping/security.md | 4 - docs/apps/stable/snipe-it/CHANGELOG.md | 9 + docs/apps/stable/snipe-it/index.md | 4 +- docs/apps/stable/snipe-it/security.md | 16 +- docs/apps/stable/sonarr/CHANGELOG.md | 10 + docs/apps/stable/sonarr/helm-values.md | 2 +- docs/apps/stable/sonarr/index.md | 2 +- docs/apps/stable/sonarr/security.md | 13 +- .../stable/speedtest-exporter/CHANGELOG.md | 9 + docs/apps/stable/speedtest-exporter/index.md | 2 +- .../stable/speedtest-exporter/security.md | 4 +- docs/apps/stable/sqlitebrowser/CHANGELOG.md | 9 + docs/apps/stable/sqlitebrowser/index.md | 2 +- docs/apps/stable/sqlitebrowser/security.md | 5 +- docs/apps/stable/stash/CHANGELOG.md | 9 + docs/apps/stable/stash/index.md | 2 +- docs/apps/stable/stash/security.md | 9 +- docs/apps/stable/static/CHANGELOG.md | 9 + docs/apps/stable/static/index.md | 2 +- docs/apps/stable/static/security.md | 4 - docs/apps/stable/statping/CHANGELOG.md | 9 + docs/apps/stable/statping/index.md | 4 +- docs/apps/stable/statping/security.md | 20 +- docs/apps/stable/synclounge/CHANGELOG.md | 9 + docs/apps/stable/synclounge/index.md | 2 +- docs/apps/stable/synclounge/security.md | 3 - docs/apps/stable/syncthing/CHANGELOG.md | 9 + docs/apps/stable/syncthing/index.md | 2 +- docs/apps/stable/syncthing/security.md | 5 +- docs/apps/stable/syslog-ng/CHANGELOG.md | 9 + docs/apps/stable/syslog-ng/index.md | 2 +- docs/apps/stable/syslog-ng/security.md | 3 - docs/apps/stable/tautulli/CHANGELOG.md | 10 + docs/apps/stable/tautulli/helm-values.md | 2 +- docs/apps/stable/tautulli/index.md | 2 +- docs/apps/stable/tautulli/security.md | 18 +- docs/apps/stable/teamspeak3/CHANGELOG.md | 9 + docs/apps/stable/teamspeak3/index.md | 2 +- docs/apps/stable/teamspeak3/security.md | 4 - docs/apps/stable/teedy/CHANGELOG.md | 9 + docs/apps/stable/teedy/index.md | 4 +- docs/apps/stable/teedy/security.md | 23 +- docs/apps/stable/thelounge/CHANGELOG.md | 9 + docs/apps/stable/thelounge/index.md | 2 +- docs/apps/stable/thelounge/security.md | 18 +- docs/apps/stable/traccar/CHANGELOG.md | 9 + docs/apps/stable/traccar/index.md | 4 +- docs/apps/stable/traccar/security.md | 19 +- docs/apps/stable/transmission/CHANGELOG.md | 9 + docs/apps/stable/transmission/index.md | 2 +- docs/apps/stable/transmission/security.md | 9 +- docs/apps/stable/truecommand/CHANGELOG.md | 9 + docs/apps/stable/truecommand/index.md | 2 +- docs/apps/stable/truecommand/security.md | 17 +- docs/apps/stable/tt-rss/CHANGELOG.md | 9 + docs/apps/stable/tt-rss/index.md | 4 +- docs/apps/stable/tt-rss/security.md | 22 +- docs/apps/stable/tvheadend/CHANGELOG.md | 9 + docs/apps/stable/tvheadend/index.md | 2 +- docs/apps/stable/tvheadend/security.md | 4 - docs/apps/stable/twtxt/CHANGELOG.md | 9 + docs/apps/stable/twtxt/index.md | 2 +- docs/apps/stable/twtxt/security.md | 5 +- docs/apps/stable/ubooquity/CHANGELOG.md | 9 + docs/apps/stable/ubooquity/index.md | 2 +- docs/apps/stable/ubooquity/security.md | 3 - docs/apps/stable/unifi/CHANGELOG.md | 9 + docs/apps/stable/unifi/index.md | 2 +- docs/apps/stable/unifi/security.md | 6 +- docs/apps/stable/unpackerr/CHANGELOG.md | 9 + docs/apps/stable/unpackerr/index.md | 2 +- docs/apps/stable/unpackerr/security.md | 5 +- docs/apps/stable/unpoller/CHANGELOG.md | 9 + docs/apps/stable/unpoller/index.md | 2 +- docs/apps/stable/unpoller/security.md | 5 +- docs/apps/stable/uptime-kuma/CHANGELOG.md | 9 + docs/apps/stable/uptime-kuma/index.md | 2 +- docs/apps/stable/uptime-kuma/security.md | 4 - .../uptimerobot-prometheus/CHANGELOG.md | 9 + .../stable/uptimerobot-prometheus/index.md | 2 +- .../stable/uptimerobot-prometheus/security.md | 5 +- docs/apps/stable/valheim/CHANGELOG.md | 9 + docs/apps/stable/valheim/index.md | 2 +- docs/apps/stable/valheim/security.md | 18 +- docs/apps/stable/vaultwarden/CHANGELOG.md | 9 + docs/apps/stable/vaultwarden/index.md | 4 +- docs/apps/stable/vaultwarden/security.md | 33 +- docs/apps/stable/webgrabplus/CHANGELOG.md | 9 + docs/apps/stable/webgrabplus/index.md | 2 +- docs/apps/stable/webgrabplus/security.md | 3 - docs/apps/stable/whoogle/CHANGELOG.md | 9 + docs/apps/stable/whoogle/index.md | 2 +- docs/apps/stable/whoogle/security.md | 4 - docs/apps/stable/wikijs/CHANGELOG.md | 9 + docs/apps/stable/wikijs/index.md | 4 +- docs/apps/stable/wikijs/security.md | 18 +- docs/apps/stable/wireshark/CHANGELOG.md | 9 + docs/apps/stable/wireshark/index.md | 2 +- docs/apps/stable/wireshark/security.md | 4 +- docs/apps/stable/xbackbone/CHANGELOG.md | 9 + docs/apps/stable/xbackbone/index.md | 4 +- docs/apps/stable/xbackbone/security.md | 12 +- docs/apps/stable/xteve/CHANGELOG.md | 9 + docs/apps/stable/xteve/index.md | 2 +- docs/apps/stable/xteve/security.md | 9 +- docs/apps/stable/zigbee2mqtt/CHANGELOG.md | 9 + docs/apps/stable/zigbee2mqtt/index.md | 2 +- docs/apps/stable/zigbee2mqtt/security.md | 5 +- docs/apps/stable/znc/CHANGELOG.md | 9 + docs/apps/stable/znc/index.md | 2 +- docs/apps/stable/znc/security.md | 3 - docs/apps/stable/zwavejs2mqtt/CHANGELOG.md | 9 + docs/apps/stable/zwavejs2mqtt/index.md | 2 +- docs/apps/stable/zwavejs2mqtt/security.md | 5 +- docs/index.yaml | 7329 ++++++++++++++++- 1345 files changed, 13388 insertions(+), 3755 deletions(-) diff --git a/charts/core/k8s-gateway/CHANGELOG.md b/charts/core/k8s-gateway/CHANGELOG.md index 06914596f8b..b59ac4f37a6 100644 --- a/charts/core/k8s-gateway/CHANGELOG.md +++ b/charts/core/k8s-gateway/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [k8s-gateway-4.0.26](https://github.com/truecharts/apps/compare/k8s-gateway-4.0.25...k8s-gateway-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [k8s-gateway-4.0.25](https://github.com/truecharts/apps/compare/k8s-gateway-4.0.24...k8s-gateway-4.0.25) (2021-12-19) diff --git a/charts/core/k8s-gateway/README.md b/charts/core/k8s-gateway/README.md index fb31303ec73..30dde411861 100644 --- a/charts/core/k8s-gateway/README.md +++ b/charts/core/k8s-gateway/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/core/k8s-gateway/security.md b/charts/core/k8s-gateway/security.md index 17f2db517d1..0add1f22212 100644 --- a/charts/core/k8s-gateway/security.md +++ b/charts/core/k8s-gateway/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -81,4 +77,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| go.etcd.io/etcd | CVE-2020-15106 | MEDIUM | v0.5.0-alpha.5.0.20200306183522-221f0cc107cb | v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15106
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
| +| go.etcd.io/etcd | CVE-2020-15106 | MEDIUM | v0.5.0-alpha.5.0.20200306183522-221f0cc107cb | 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15106
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/charts/core/prometheus/CHANGELOG.md b/charts/core/prometheus/CHANGELOG.md index 71575f7554c..300bcf5a5de 100644 --- a/charts/core/prometheus/CHANGELOG.md +++ b/charts/core/prometheus/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [prometheus-1.1.27](https://github.com/truecharts/apps/compare/prometheus-1.1.26...prometheus-1.1.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [prometheus-1.1.26](https://github.com/truecharts/apps/compare/prometheus-1.1.25...prometheus-1.1.26) (2021-12-20) diff --git a/charts/core/prometheus/README.md b/charts/core/prometheus/README.md index 9dbd0bae26f..100883a5b56 100644 --- a/charts/core/prometheus/README.md +++ b/charts/core/prometheus/README.md @@ -20,7 +20,7 @@ Kubernetes: `>=1.16.0-0` |------------|------|---------| | https://charts.bitnami.com/bitnami | kube-state-metrics | 2.1.19 | | https://charts.bitnami.com/bitnami | node-exporter | 2.3.17 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/core/prometheus/helm-values.md b/charts/core/prometheus/helm-values.md index 1744fb6575b..9278bf609fe 100644 --- a/charts/core/prometheus/helm-values.md +++ b/charts/core/prometheus/helm-values.md @@ -88,7 +88,7 @@ You will, however, be able to use all values referenced in the common chart here | alertmanager.volumeMounts | list | `[]` | | | alertmanager.volumes | list | `[]` | | | alertmanagerImage.repository | string | `"tccr.io/truecharts/alertmanager"` | | -| alertmanagerImage.tag | string | `"v0.23.0@sha256:a60e78b7c55a3a4f541e93471b521ee183bd299bd6a1631e300dc1ddda02f8f1"` | | +| alertmanagerImage.tag | string | `"v0.23.0@sha256:a367a332ed5ca80f49219f3b53680cac1b866b80cad39c2d1b003f8068536cf8"` | | | coreDns.enabled | bool | `true` | | | coreDns.namespace | string | `"kube-system"` | | | coreDns.service.enabled | bool | `true` | | @@ -317,7 +317,7 @@ You will, however, be able to use all values referenced in the common chart here | prometheus.volumes | list | `[]` | | | prometheus.walCompression | bool | `false` | | | prometheusImage.repository | string | `"tccr.io/truecharts/prometheus"` | | -| prometheusImage.tag | string | `"v2.32.1@sha256:98e8a2e885ae6b8b9625fc0c987d30b5040ce921f46af2f7ba70c2edb42b4eee"` | | +| prometheusImage.tag | string | `"v2.32.1@sha256:71ad47195bb1d4334a7b77d358f67037639c34cf887c7fa95abc2a9c567bee43"` | | | rbac | object | `{"enabled":true,"rules":[{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["create"]},{"apiGroups":["apiextensions.k8s.io"],"resourceNames":["alertmanagers.monitoring.coreos.com","podmonitors.monitoring.coreos.com","prometheuses.monitoring.coreos.com","prometheusrules.monitoring.coreos.com","servicemonitors.monitoring.coreos.com","thanosrulers.monitoring.coreos.com","probes.monitoring.coreos.com"],"resources":["customresourcedefinitions"],"verbs":["get","update"]},{"apiGroups":["monitoring.coreos.com"],"resources":["alertmanagers","alertmanagers/finalizers","alertmanagerconfigs","prometheuses","prometheuses/finalizers","thanosrulers","thanosrulers/finalizers","servicemonitors","podmonitors","probes","prometheusrules"],"verbs":["*"]},{"apiGroups":["apps"],"resources":["statefulsets"],"verbs":["*"]},{"apiGroups":[""],"resources":["configmaps","secrets"],"verbs":["*"]},{"apiGroups":[""],"resources":["pods"],"verbs":["list","delete"]},{"apiGroups":[""],"resources":["services","services/finalizers","endpoints"],"verbs":["get","create","update","delete"]},{"apiGroups":[""],"resources":["nodes"],"verbs":["list","watch"]},{"apiGroups":[""],"resources":["namespaces"],"verbs":["get","list","watch"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses"],"verbs":["get","list","watch"]}]}` | Whether Role Based Access Control objects like roles and rolebindings should be created | | securityContext.readOnlyRootFilesystem | bool | `false` | | | service.alertmanager.enabled | bool | `true` | | diff --git a/charts/core/prometheus/security.md b/charts/core/prometheus/security.md index 0f968ef0aec..f3c55d383dc 100644 --- a/charts/core/prometheus/security.md +++ b/charts/core/prometheus/security.md @@ -25,9 +25,9 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-kube-state-metrics' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -55,15 +55,14 @@ hide: | Kubernetes Security Check | KSV009 | Access to host network | HIGH |
Expand... Sharing the host’s network namespace permits processes in the pod to communicate with processes bound to the host’s loopback adapter.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostNetwork' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv009
| | Kubernetes Security Check | KSV010 | Access to host PID | HIGH |
Expand... Sharing the host’s PID namespace allows visibility on host processes, potentially leaking information such as environment variables and configuration.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostPID' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv010
| | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| -| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV023 | hostPath volumes mounted | MEDIUM |
Expand... HostPath volumes must be forbidden.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.volumes.hostPath'
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv023
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

DaemonSet 'RELEASE-NAME-node-exporter' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -98,9 +97,7 @@ hide: | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| @@ -122,12 +119,6 @@ hide: | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -140,6 +131,7 @@ hide: | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-prometheus' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -540,10 +532,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: bitnami/kube-state-metrics:2.3.0-debian-10-r0 (debian 10.11) diff --git a/charts/core/traefik/CHANGELOG.md b/charts/core/traefik/CHANGELOG.md index ffcedb218c2..8a7b9e64788 100644 --- a/charts/core/traefik/CHANGELOG.md +++ b/charts/core/traefik/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [traefik-10.0.29](https://github.com/truecharts/apps/compare/traefik-10.0.28...traefik-10.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [traefik-10.0.28](https://github.com/truecharts/apps/compare/traefik-10.0.27...traefik-10.0.28) (2021-12-19) diff --git a/charts/core/traefik/README.md b/charts/core/traefik/README.md index ef22a86294b..bbd5b57d7e5 100644 --- a/charts/core/traefik/README.md +++ b/charts/core/traefik/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/core/traefik/security.md b/charts/core/traefik/security.md index 59ba60331b9..7a5629215da 100644 --- a/charts/core/traefik/security.md +++ b/charts/core/traefik/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traefik' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -97,5 +94,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/charts/incubator/omada-controller/CHANGELOG.md b/charts/incubator/omada-controller/CHANGELOG.md index 03022927ed5..13aee3bd21b 100644 --- a/charts/incubator/omada-controller/CHANGELOG.md +++ b/charts/incubator/omada-controller/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [omada-controller-4.0.37](https://github.com/truecharts/apps/compare/omada-controller-4.0.36...omada-controller-4.0.37) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [omada-controller-4.0.36](https://github.com/truecharts/apps/compare/omada-controller-4.0.35...omada-controller-4.0.36) (2021-12-20) diff --git a/charts/incubator/omada-controller/README.md b/charts/incubator/omada-controller/README.md index fed445b9a42..c00c19f5b77 100644 --- a/charts/incubator/omada-controller/README.md +++ b/charts/incubator/omada-controller/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/incubator/omada-controller/security.md b/charts/incubator/omada-controller/security.md index e5a20b09108..1ce6222ecb4 100644 --- a/charts/incubator/omada-controller/security.md +++ b/charts/incubator/omada-controller/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -249,7 +245,7 @@ hide: | commons-beanutils:commons-beanutils | CVE-2019-10086 | HIGH | 1.9.3 | 1.9.4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e
https://access.redhat.com/errata/RHSA-2019:4317
https://access.redhat.com/errata/RHSA-2020:0057
https://access.redhat.com/errata/RHSA-2020:0194
https://access.redhat.com/errata/RHSA-2020:0804
https://access.redhat.com/errata/RHSA-2020:0805
https://access.redhat.com/errata/RHSA-2020:0806
https://access.redhat.com/errata/RHSA-2020:0811
https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086
https://github.com/advisories/GHSA-6phf-73q6-gh87
https://github.com/apache/commons-beanutils/commit/dd48f4e589462a8cdb1f29bbbccb35d6b0291d58
https://github.com/apache/commons-beanutils/pull/7
https://issues.apache.org/jira/browse/BEANUTILS-520
https://linux.oracle.com/cve/CVE-2019-10086.html
https://linux.oracle.com/errata/ELSA-2020-0194.html
https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db@%3Cdev.rocketmq.apache.org%3E
https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825@%3Ccommits.dolphinscheduler.apache.org%3E
https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E
https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%3E
https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E
https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
https://nvd.nist.gov/vuln/detail/CVE-2019-10086
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.2 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.7 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.poi:poi | CVE-2017-12626 | HIGH | 3.15 | 3.17 |
Expand...http://www.securityfocus.com/bid/102879
https://access.redhat.com/errata/RHSA-2018:1322
https://bz.apache.org/bugzilla/show_bug.cgi?id=52372
https://bz.apache.org/bugzilla/show_bug.cgi?id=61294
https://bz.apache.org/bugzilla/show_bug.cgi?id=61295
https://bz.apache.org/bugzilla/show_bug.cgi?id=61338
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12626
https://github.com/advisories/GHSA-523c-xh4g-mh5m
https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-12626
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.poi:poi | CVE-2019-12415 | MEDIUM | 3.15 | 4.1.1 |
Expand...https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-12415
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.shiro:shiro-core | CVE-2020-11989 | CRITICAL | 1.4.0 | 1.5.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11989
https://github.com/advisories/GHSA-72w9-fcj5-3fcg
https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249d646d7abadb807ebf90f6fd2b014df21@%3Cdev.geode.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675@%3Cuser.shiro.apache.org%3E
https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rcf3d8041e1232201fe5d74fc612a193e435784d64002409b448b58fe@%3Cdev.geode.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-11989
https://ubuntu.com/security/notices/USN-4740-1
https://www.openwall.com/lists/oss-security/2020/06/22/1
| diff --git a/charts/incubator/tdarr-node/CHANGELOG.md b/charts/incubator/tdarr-node/CHANGELOG.md index 549f1d9a5dc..869ee6e9d45 100644 --- a/charts/incubator/tdarr-node/CHANGELOG.md +++ b/charts/incubator/tdarr-node/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tdarr-node-1.0.30](https://github.com/truecharts/apps/compare/tdarr-node-1.0.29...tdarr-node-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tdarr-node-1.0.29](https://github.com/truecharts/apps/compare/tdarr-node-1.0.28...tdarr-node-1.0.29) (2021-12-19) diff --git a/charts/incubator/tdarr-node/README.md b/charts/incubator/tdarr-node/README.md index d86984d12c8..7def8761cce 100644 --- a/charts/incubator/tdarr-node/README.md +++ b/charts/incubator/tdarr-node/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/incubator/tdarr-node/security.md b/charts/incubator/tdarr-node/security.md index 4509d83bb26..44a18037fe0 100644 --- a/charts/incubator/tdarr-node/security.md +++ b/charts/incubator/tdarr-node/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/incubator/tdarr/CHANGELOG.md b/charts/incubator/tdarr/CHANGELOG.md index d7ef2fe5c38..6971dd539b0 100644 --- a/charts/incubator/tdarr/CHANGELOG.md +++ b/charts/incubator/tdarr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tdarr-1.0.30](https://github.com/truecharts/apps/compare/tdarr-node-1.0.29...tdarr-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tdarr-1.0.29](https://github.com/truecharts/apps/compare/tdarr-node-1.0.28...tdarr-1.0.29) (2021-12-19) diff --git a/charts/incubator/tdarr/README.md b/charts/incubator/tdarr/README.md index e8508cc144a..2cd4a27130e 100644 --- a/charts/incubator/tdarr/README.md +++ b/charts/incubator/tdarr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/incubator/tdarr/security.md b/charts/incubator/tdarr/security.md index 131dece3b51..3a08ab3f0dd 100644 --- a/charts/incubator/tdarr/security.md +++ b/charts/incubator/tdarr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/airsonic/CHANGELOG.md b/charts/stable/airsonic/CHANGELOG.md index aee2535adb4..0144691574d 100644 --- a/charts/stable/airsonic/CHANGELOG.md +++ b/charts/stable/airsonic/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [airsonic-4.0.28](https://github.com/truecharts/apps/compare/airsonic-4.0.27...airsonic-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [airsonic-4.0.27](https://github.com/truecharts/apps/compare/airsonic-4.0.26...airsonic-4.0.27) (2021-12-19) diff --git a/charts/stable/airsonic/README.md b/charts/stable/airsonic/README.md index 12ac7cf642b..b00ab32e25c 100644 --- a/charts/stable/airsonic/README.md +++ b/charts/stable/airsonic/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/airsonic/security.md b/charts/stable/airsonic/security.md index 7b30023aea5..e32b90639ba 100644 --- a/charts/stable/airsonic/security.md +++ b/charts/stable/airsonic/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/amcrest2mqtt/CHANGELOG.md b/charts/stable/amcrest2mqtt/CHANGELOG.md index ca674c84c14..9577838e512 100644 --- a/charts/stable/amcrest2mqtt/CHANGELOG.md +++ b/charts/stable/amcrest2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [amcrest2mqtt-2.0.28](https://github.com/truecharts/apps/compare/amcrest2mqtt-2.0.27...amcrest2mqtt-2.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [amcrest2mqtt-2.0.27](https://github.com/truecharts/apps/compare/amcrest2mqtt-2.0.26...amcrest2mqtt-2.0.27) (2021-12-19) diff --git a/charts/stable/amcrest2mqtt/README.md b/charts/stable/amcrest2mqtt/README.md index 443025825ba..a1e34d2bcc7 100644 --- a/charts/stable/amcrest2mqtt/README.md +++ b/charts/stable/amcrest2mqtt/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/amcrest2mqtt/security.md b/charts/stable/amcrest2mqtt/security.md index 58377914544..3c570d775da 100644 --- a/charts/stable/amcrest2mqtt/security.md +++ b/charts/stable/amcrest2mqtt/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/anonaddy/CHANGELOG.md b/charts/stable/anonaddy/CHANGELOG.md index 69fce825f82..bc456cad70d 100644 --- a/charts/stable/anonaddy/CHANGELOG.md +++ b/charts/stable/anonaddy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [anonaddy-6.0.18](https://github.com/truecharts/apps/compare/anonaddy-6.0.17...anonaddy-6.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [anonaddy-6.0.17](https://github.com/truecharts/apps/compare/anonaddy-6.0.16...anonaddy-6.0.17) (2021-12-19) diff --git a/charts/stable/anonaddy/README.md b/charts/stable/anonaddy/README.md index 0cd02399042..0d138b941be 100644 --- a/charts/stable/anonaddy/README.md +++ b/charts/stable/anonaddy/README.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/anonaddy/security.md b/charts/stable/anonaddy/security.md index e1eda9157b3..5327323aee0 100644 --- a/charts/stable/anonaddy/security.md +++ b/charts/stable/anonaddy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,12 +46,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -73,9 +61,9 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/anonaddy:v0.8.9@sha256:7e6295239394c21d94fa370d6a1fbab5b35fd06026f47ba8a35a9d367d763254 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -180,7 +168,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** @@ -382,7 +370,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/apache-musicindex/CHANGELOG.md b/charts/stable/apache-musicindex/CHANGELOG.md index 935ae3a93b6..64b21ad7452 100644 --- a/charts/stable/apache-musicindex/CHANGELOG.md +++ b/charts/stable/apache-musicindex/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [apache-musicindex-2.0.26](https://github.com/truecharts/apps/compare/apache-musicindex-2.0.25...apache-musicindex-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [apache-musicindex-2.0.25](https://github.com/truecharts/apps/compare/apache-musicindex-2.0.24...apache-musicindex-2.0.25) (2021-12-19) diff --git a/charts/stable/apache-musicindex/README.md b/charts/stable/apache-musicindex/README.md index 52fa7ba7192..47125b74f87 100644 --- a/charts/stable/apache-musicindex/README.md +++ b/charts/stable/apache-musicindex/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/apache-musicindex/security.md b/charts/stable/apache-musicindex/security.md index c0040484365..4ea215b8617 100644 --- a/charts/stable/apache-musicindex/security.md +++ b/charts/stable/apache-musicindex/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -88,24 +84,32 @@ hide: | apache2 | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2 | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2 | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-bin | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-bin | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-bin | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-data | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-data | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-data | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-utils | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-utils | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-utils | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| | curl | CVE-2021-22924 | MEDIUM | 7.68.0-1ubuntu2.5 | 7.68.0-1ubuntu2.6 |
Expand...https://curl.se/docs/CVE-2021-22924.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924
https://hackerone.com/reports/1223565
https://linux.oracle.com/cve/CVE-2021-22924.html
https://linux.oracle.com/errata/ELSA-2021-3582.html
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
https://security.netapp.com/advisory/ntap-20210902-0003/
https://ubuntu.com/security/notices/USN-5021-1
https://www.oracle.com/security-alerts/cpuoct2021.html
| @@ -281,4 +285,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/appdaemon/CHANGELOG.md b/charts/stable/appdaemon/CHANGELOG.md index d608e8cfda6..1cb65541ef9 100644 --- a/charts/stable/appdaemon/CHANGELOG.md +++ b/charts/stable/appdaemon/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [appdaemon-7.0.7](https://github.com/truecharts/apps/compare/appdaemon-7.0.6...appdaemon-7.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [appdaemon-7.0.6](https://github.com/truecharts/apps/compare/appdaemon-7.0.5...appdaemon-7.0.6) (2021-12-19) diff --git a/charts/stable/appdaemon/README.md b/charts/stable/appdaemon/README.md index 136a7db9dbd..24097bb3120 100644 --- a/charts/stable/appdaemon/README.md +++ b/charts/stable/appdaemon/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/appdaemon/security.md b/charts/stable/appdaemon/security.md index 2dea711c709..f23929d7c40 100644 --- a/charts/stable/appdaemon/security.md +++ b/charts/stable/appdaemon/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/aria2/CHANGELOG.md b/charts/stable/aria2/CHANGELOG.md index 4d1df81ab80..c8b7036efcf 100644 --- a/charts/stable/aria2/CHANGELOG.md +++ b/charts/stable/aria2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [aria2-3.0.7](https://github.com/truecharts/apps/compare/aria2-3.0.6...aria2-3.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [aria2-3.0.6](https://github.com/truecharts/apps/compare/aria2-3.0.5...aria2-3.0.6) (2021-12-19) diff --git a/charts/stable/aria2/README.md b/charts/stable/aria2/README.md index bc98ee1c7f0..d1da70e551d 100644 --- a/charts/stable/aria2/README.md +++ b/charts/stable/aria2/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/aria2/security.md b/charts/stable/aria2/security.md index dc8bfa4abb8..403b6c48963 100644 --- a/charts/stable/aria2/security.md +++ b/charts/stable/aria2/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/audacity/CHANGELOG.md b/charts/stable/audacity/CHANGELOG.md index eaeaad40d33..7f2fdc592f2 100644 --- a/charts/stable/audacity/CHANGELOG.md +++ b/charts/stable/audacity/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [audacity-2.0.26](https://github.com/truecharts/apps/compare/audacity-2.0.25...audacity-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [audacity-2.0.25](https://github.com/truecharts/apps/compare/audacity-2.0.24...audacity-2.0.25) (2021-12-19) diff --git a/charts/stable/audacity/README.md b/charts/stable/audacity/README.md index f7d0596cb3f..1d28cd7bb89 100644 --- a/charts/stable/audacity/README.md +++ b/charts/stable/audacity/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/audacity/security.md b/charts/stable/audacity/security.md index 7693da94044..734643225aa 100644 --- a/charts/stable/audacity/security.md +++ b/charts/stable/audacity/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/authelia/CHANGELOG.md b/charts/stable/authelia/CHANGELOG.md index 67b2548dc8b..0513f2af7d3 100644 --- a/charts/stable/authelia/CHANGELOG.md +++ b/charts/stable/authelia/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [authelia-8.0.21](https://github.com/truecharts/apps/compare/authelia-8.0.20...authelia-8.0.21) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [authelia-8.0.20](https://github.com/truecharts/apps/compare/authelia-8.0.19...authelia-8.0.20) (2021-12-19) diff --git a/charts/stable/authelia/README.md b/charts/stable/authelia/README.md index 5efa29ccb2d..451ce576a27 100644 --- a/charts/stable/authelia/README.md +++ b/charts/stable/authelia/README.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org/ | redis | 1.0.39 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org/ | redis | 1.0.42 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/authelia/security.md b/charts/stable/authelia/security.md index a277812d6f7..7f5722c2da0 100644 --- a/charts/stable/authelia/security.md +++ b/charts/stable/authelia/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,32 +47,27 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-authelia' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/authelia:v4.33.1@sha256:e4c82afea63b9f9985fb597a75ebc637ee6cbc7a78d92de53829f8aa4bed4178 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -117,7 +104,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -385,7 +372,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -633,7 +620,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/babybuddy/CHANGELOG.md b/charts/stable/babybuddy/CHANGELOG.md index 37c6285c718..475a3412f21 100644 --- a/charts/stable/babybuddy/CHANGELOG.md +++ b/charts/stable/babybuddy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [babybuddy-5.0.23](https://github.com/truecharts/apps/compare/babybuddy-5.0.22...babybuddy-5.0.23) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [babybuddy-5.0.22](https://github.com/truecharts/apps/compare/babybuddy-5.0.21...babybuddy-5.0.22) (2021-12-20) diff --git a/charts/stable/babybuddy/README.md b/charts/stable/babybuddy/README.md index 24889e69f13..40e08dfed91 100644 --- a/charts/stable/babybuddy/README.md +++ b/charts/stable/babybuddy/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/babybuddy/security.md b/charts/stable/babybuddy/security.md index 19fb55232e6..a6ec37f8bf8 100644 --- a/charts/stable/babybuddy/security.md +++ b/charts/stable/babybuddy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,14 +36,8 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/babybuddy:v1.9.3@sha256:254668977f7efbf6e631b3a5155744a7ce194075b7336ad0f136e5d5e4de3077 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -368,7 +358,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/bazarr/CHANGELOG.md b/charts/stable/bazarr/CHANGELOG.md index 198427e5c52..f6694d6df8f 100644 --- a/charts/stable/bazarr/CHANGELOG.md +++ b/charts/stable/bazarr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [bazarr-9.0.29](https://github.com/truecharts/apps/compare/bazarr-9.0.28...bazarr-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [bazarr-9.0.28](https://github.com/truecharts/apps/compare/bazarr-9.0.27...bazarr-9.0.28) (2021-12-20) diff --git a/charts/stable/bazarr/README.md b/charts/stable/bazarr/README.md index 25981fdd49e..34f7b9a8fd0 100644 --- a/charts/stable/bazarr/README.md +++ b/charts/stable/bazarr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/bazarr/security.md b/charts/stable/bazarr/security.md index 3caa9dbd9f3..4fe5e860f87 100644 --- a/charts/stable/bazarr/security.md +++ b/charts/stable/bazarr/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-bazarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -742,4 +739,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/beets/CHANGELOG.md b/charts/stable/beets/CHANGELOG.md index 22927249a75..0a0917cec23 100644 --- a/charts/stable/beets/CHANGELOG.md +++ b/charts/stable/beets/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [beets-2.0.29](https://github.com/truecharts/apps/compare/beets-2.0.28...beets-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [beets-2.0.28](https://github.com/truecharts/apps/compare/beets-2.0.27...beets-2.0.28) (2021-12-19) diff --git a/charts/stable/beets/README.md b/charts/stable/beets/README.md index 8b93eae9b6b..3b8a5b42f2c 100644 --- a/charts/stable/beets/README.md +++ b/charts/stable/beets/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/beets/security.md b/charts/stable/beets/security.md index 80266d8553d..1a97e05538d 100644 --- a/charts/stable/beets/security.md +++ b/charts/stable/beets/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/blog/CHANGELOG.md b/charts/stable/blog/CHANGELOG.md index 023a70e56a9..ad49651a2dc 100644 --- a/charts/stable/blog/CHANGELOG.md +++ b/charts/stable/blog/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [blog-0.0.16](https://github.com/truecharts/apps/compare/blog-0.0.15...blog-0.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [blog-0.0.15](https://github.com/truecharts/apps/compare/blog-0.0.14...blog-0.0.15) (2021-12-19) diff --git a/charts/stable/blog/README.md b/charts/stable/blog/README.md index 0caf50db065..77abdb2d459 100644 --- a/charts/stable/blog/README.md +++ b/charts/stable/blog/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/blog/security.md b/charts/stable/blog/security.md index 02b0f45a56a..94e738a8ccf 100644 --- a/charts/stable/blog/security.md +++ b/charts/stable/blog/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/blog:latest@sha256:8f8164929c47c071024cabf591fbaea4f468dcddf3c276c3114d754c9e24dc47 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -325,6 +315,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -333,6 +325,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -341,6 +335,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -349,6 +345,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -583,7 +581,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -595,7 +593,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -605,15 +603,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -656,7 +656,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -714,7 +718,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/boinc/CHANGELOG.md b/charts/stable/boinc/CHANGELOG.md index b5561527e59..6f4be36ad6b 100644 --- a/charts/stable/boinc/CHANGELOG.md +++ b/charts/stable/boinc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [boinc-0.0.7](https://github.com/truecharts/apps/compare/boinc-0.0.6...boinc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [boinc-0.0.6](https://github.com/truecharts/apps/compare/boinc-0.0.5...boinc-0.0.6) (2021-12-19) diff --git a/charts/stable/boinc/README.md b/charts/stable/boinc/README.md index 2a2a4ad1352..7c980d56336 100644 --- a/charts/stable/boinc/README.md +++ b/charts/stable/boinc/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/boinc/security.md b/charts/stable/boinc/security.md index 8ecaeb6218a..24e058efcbd 100644 --- a/charts/stable/boinc/security.md +++ b/charts/stable/boinc/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -310,3 +307,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/booksonic-air/CHANGELOG.md b/charts/stable/booksonic-air/CHANGELOG.md index d7611377db0..a8c980a3e82 100644 --- a/charts/stable/booksonic-air/CHANGELOG.md +++ b/charts/stable/booksonic-air/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [booksonic-air-4.0.28](https://github.com/truecharts/apps/compare/booksonic-air-4.0.27...booksonic-air-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [booksonic-air-4.0.27](https://github.com/truecharts/apps/compare/booksonic-air-4.0.26...booksonic-air-4.0.27) (2021-12-19) diff --git a/charts/stable/booksonic-air/README.md b/charts/stable/booksonic-air/README.md index 08ec43af139..2a6b41c4051 100644 --- a/charts/stable/booksonic-air/README.md +++ b/charts/stable/booksonic-air/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/booksonic-air/security.md b/charts/stable/booksonic-air/security.md index 9b918a720f1..436c6a3e774 100644 --- a/charts/stable/booksonic-air/security.md +++ b/charts/stable/booksonic-air/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -728,8 +724,8 @@ hide: | org.apache.ant:ant | CVE-2021-36374 | MEDIUM | 1.10.5 | 1.9.16, 1.10.11 |
Expand...https://ant.apache.org/security.html
https://github.com/advisories/GHSA-5v34-g2px-j4fw
https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a@%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d@%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a@%3Cnotifications.groovy.apache.org%3E
https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6@%3Cdev.myfaces.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-36374
https://security.netapp.com/advisory/ntap-20210819-0007/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.12 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.13.2 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.2 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.13.2 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.13.2 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.2 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 9.0.37 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 9.0.37 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25329 | HIGH | 9.0.37 | 7.0.108, 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/2
https://github.com/advisories/GHSA-jgwr-3qm3-26f3
https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25329
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/charts/stable/bookstack/CHANGELOG.md b/charts/stable/bookstack/CHANGELOG.md index c4c62c5c30f..4e7fb246dfb 100644 --- a/charts/stable/bookstack/CHANGELOG.md +++ b/charts/stable/bookstack/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [bookstack-0.0.16](https://github.com/truecharts/apps/compare/bookstack-0.0.15...bookstack-0.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [bookstack-0.0.15](https://github.com/truecharts/apps/compare/bookstack-0.0.14...bookstack-0.0.15) (2021-12-19) diff --git a/charts/stable/bookstack/README.md b/charts/stable/bookstack/README.md index 276f2a3dad3..8b1660edbf7 100644 --- a/charts/stable/bookstack/README.md +++ b/charts/stable/bookstack/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/bookstack/security.md b/charts/stable/bookstack/security.md index c6cf255e2ca..9f1ccf21160 100644 --- a/charts/stable/bookstack/security.md +++ b/charts/stable/bookstack/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/bookstack:v21.11.20211118@sha256:f56ca2e8e3a74e5753700e5835c017264a1ca9b1a9a6740d25a50a003815149e tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,7 +93,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.70.2 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.70.2 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.3.10 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| @@ -137,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/calibre-web/CHANGELOG.md b/charts/stable/calibre-web/CHANGELOG.md index 4b153b6bcc7..b83f917b1f5 100644 --- a/charts/stable/calibre-web/CHANGELOG.md +++ b/charts/stable/calibre-web/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [calibre-web-9.0.26](https://github.com/truecharts/apps/compare/calibre-web-9.0.25...calibre-web-9.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [calibre-web-9.0.25](https://github.com/truecharts/apps/compare/calibre-web-9.0.24...calibre-web-9.0.25) (2021-12-19) diff --git a/charts/stable/calibre-web/README.md b/charts/stable/calibre-web/README.md index 632c520e09d..55c5f3f5cae 100644 --- a/charts/stable/calibre-web/README.md +++ b/charts/stable/calibre-web/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/calibre-web/security.md b/charts/stable/calibre-web/security.md index 1574ec0ed2a..62e5ed05d0d 100644 --- a/charts/stable/calibre-web/security.md +++ b/charts/stable/calibre-web/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/calibre/CHANGELOG.md b/charts/stable/calibre/CHANGELOG.md index ae0ccc4cc5b..da93e83acef 100644 --- a/charts/stable/calibre/CHANGELOG.md +++ b/charts/stable/calibre/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [calibre-5.0.7](https://github.com/truecharts/apps/compare/calibre-5.0.6...calibre-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [calibre-5.0.6](https://github.com/truecharts/apps/compare/calibre-5.0.5...calibre-5.0.6) (2021-12-19) diff --git a/charts/stable/calibre/README.md b/charts/stable/calibre/README.md index 3c26adc957d..d1617be265f 100644 --- a/charts/stable/calibre/README.md +++ b/charts/stable/calibre/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/calibre/security.md b/charts/stable/calibre/security.md index db8cc4f1d47..008d35eec2b 100644 --- a/charts/stable/calibre/security.md +++ b/charts/stable/calibre/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -331,3 +327,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/chevereto/CHANGELOG.md b/charts/stable/chevereto/CHANGELOG.md index a7dbb39fb4b..bb6efa1915d 100644 --- a/charts/stable/chevereto/CHANGELOG.md +++ b/charts/stable/chevereto/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [chevereto-0.0.8](https://github.com/truecharts/apps/compare/chevereto-0.0.7...chevereto-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [chevereto-0.0.7](https://github.com/truecharts/apps/compare/chevereto-0.0.6...chevereto-0.0.7) (2021-12-19) diff --git a/charts/stable/chevereto/README.md b/charts/stable/chevereto/README.md index 5b5b7f26c16..2605c704170 100644 --- a/charts/stable/chevereto/README.md +++ b/charts/stable/chevereto/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/chevereto/security.md b/charts/stable/chevereto/security.md index 238b8dddf9c..633df70a786 100644 --- a/charts/stable/chevereto/security.md +++ b/charts/stable/chevereto/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/chevereto:v1.6.0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -136,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/clarkson/CHANGELOG.md b/charts/stable/clarkson/CHANGELOG.md index 75e2a817590..af335b72f22 100644 --- a/charts/stable/clarkson/CHANGELOG.md +++ b/charts/stable/clarkson/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [clarkson-0.0.17](https://github.com/truecharts/apps/compare/clarkson-0.0.16...clarkson-0.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [clarkson-0.0.16](https://github.com/truecharts/apps/compare/clarkson-0.0.15...clarkson-0.0.16) (2021-12-19) diff --git a/charts/stable/clarkson/README.md b/charts/stable/clarkson/README.md index c04c8c3421c..45d06b63168 100644 --- a/charts/stable/clarkson/README.md +++ b/charts/stable/clarkson/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/clarkson/security.md b/charts/stable/clarkson/security.md index c00d6dd52db..a0f0b28a999 100644 --- a/charts/stable/clarkson/security.md +++ b/charts/stable/clarkson/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/clarkson:v1.1.2@sha256:a562de3138ee6e85f078f711b52ff8b376aefb7a35ab020bc4ed8f393cf7838a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -145,7 +137,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/cloud9/CHANGELOG.md b/charts/stable/cloud9/CHANGELOG.md index 60cff7291b1..bfde8cfeea1 100644 --- a/charts/stable/cloud9/CHANGELOG.md +++ b/charts/stable/cloud9/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [cloud9-2.0.29](https://github.com/truecharts/apps/compare/cloud9-2.0.28...cloud9-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [cloud9-2.0.28](https://github.com/truecharts/apps/compare/cloud9-2.0.27...cloud9-2.0.28) (2021-12-19) diff --git a/charts/stable/cloud9/README.md b/charts/stable/cloud9/README.md index 4bc97a6c907..0d0605eaccc 100644 --- a/charts/stable/cloud9/README.md +++ b/charts/stable/cloud9/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/cloud9/security.md b/charts/stable/cloud9/security.md index 23f0159d386..71b27d9c7df 100644 --- a/charts/stable/cloud9/security.md +++ b/charts/stable/cloud9/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -340,3 +336,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/code-server/CHANGELOG.md b/charts/stable/code-server/CHANGELOG.md index 5acb7fc4a3e..9c9362a287e 100644 --- a/charts/stable/code-server/CHANGELOG.md +++ b/charts/stable/code-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [code-server-2.1.9](https://github.com/truecharts/apps/compare/code-server-2.1.8...code-server-2.1.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [code-server-2.1.8](https://github.com/truecharts/apps/compare/code-server-2.1.7...code-server-2.1.8) (2021-12-19) diff --git a/charts/stable/code-server/README.md b/charts/stable/code-server/README.md index 697554504ab..bd5c82dcfa9 100644 --- a/charts/stable/code-server/README.md +++ b/charts/stable/code-server/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/code-server/security.md b/charts/stable/code-server/security.md index 82db0714044..6ef67256fa1 100644 --- a/charts/stable/code-server/security.md +++ b/charts/stable/code-server/security.md @@ -20,16 +20,13 @@ hide: | Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM |
Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.allowPrivilegeEscalation' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv001
| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-code-server' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -255,6 +252,7 @@ hide: | vim-common | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | vim-common | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | vim-common | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| vim-common | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| | vim-tiny | CVE-2021-3770 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3770
https://github.com/vim/vim/commit/2ddb89f8a94425cda1e5491efc80c1ccccb6e08e
https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2CJLY3CF55I2ULG2X4ENXLSXAXYW5J4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4FFQARG3LGREPDZRI4C7ERQL3RJKEWQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNTMVZCN4TRTTCAXRLVQ7H2P7FYAIZQ/
https://ubuntu.com/security/notices/USN-5093-1
| | vim-tiny | CVE-2021-3778 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3778
https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f
https://huntr.dev/bounties/d9c17308-2c99-4f9f-a706-f7f72c24c273
https://linux.oracle.com/cve/CVE-2021-3778.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| | vim-tiny | CVE-2021-3796 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3796
https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3
https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d
https://linux.oracle.com/cve/CVE-2021-3796.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| @@ -270,6 +268,7 @@ hide: | vim-tiny | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | vim-tiny | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | vim-tiny | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| vim-tiny | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| | xxd | CVE-2021-3770 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3770
https://github.com/vim/vim/commit/2ddb89f8a94425cda1e5491efc80c1ccccb6e08e
https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2CJLY3CF55I2ULG2X4ENXLSXAXYW5J4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4FFQARG3LGREPDZRI4C7ERQL3RJKEWQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNTMVZCN4TRTTCAXRLVQ7H2P7FYAIZQ/
https://ubuntu.com/security/notices/USN-5093-1
| | xxd | CVE-2021-3778 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3778
https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f
https://huntr.dev/bounties/d9c17308-2c99-4f9f-a706-f7f72c24c273
https://linux.oracle.com/cve/CVE-2021-3778.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| | xxd | CVE-2021-3796 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3796
https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3
https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d
https://linux.oracle.com/cve/CVE-2021-3796.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| @@ -285,6 +284,7 @@ hide: | xxd | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | xxd | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | xxd | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| xxd | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| **gobinary** @@ -292,13 +292,12 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20191206172530-e9b2fee46413 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20191206172530-e9b2fee46413 | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.1 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.1 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| | gopkg.in/yaml.v2 | GMS-2019-2 | UNKNOWN | v2.2.1 | v2.2.3 |
Expand...https://github.com/docker/cli/pull/2117
| -| gopkg.in/yaml.v2 | GO-2021-0061 | UNKNOWN | v2.2.1 | v2.2.3 |
Expand...
| +| gopkg.in/yaml.v2 | GO-2021-0061 | UNKNOWN | v2.2.1 | 2.2.3 |
Expand...
| diff --git a/charts/stable/collabora-online/CHANGELOG.md b/charts/stable/collabora-online/CHANGELOG.md index d655df75171..e6fa29750c8 100644 --- a/charts/stable/collabora-online/CHANGELOG.md +++ b/charts/stable/collabora-online/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [collabora-online-10.0.7](https://github.com/truecharts/apps/compare/collabora-online-10.0.6...collabora-online-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [collabora-online-10.0.6](https://github.com/truecharts/apps/compare/collabora-online-10.0.5...collabora-online-10.0.6) (2021-12-19) diff --git a/charts/stable/collabora-online/README.md b/charts/stable/collabora-online/README.md index 0472428fd73..5fc7a214782 100644 --- a/charts/stable/collabora-online/README.md +++ b/charts/stable/collabora-online/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/collabora-online/security.md b/charts/stable/collabora-online/security.md index 12d017e0bd9..914d816f100 100644 --- a/charts/stable/collabora-online/security.md +++ b/charts/stable/collabora-online/security.md @@ -21,12 +21,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/couchpotato/CHANGELOG.md b/charts/stable/couchpotato/CHANGELOG.md index 1237f32a857..4b47a25879f 100644 --- a/charts/stable/couchpotato/CHANGELOG.md +++ b/charts/stable/couchpotato/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [couchpotato-0.0.7](https://github.com/truecharts/apps/compare/couchpotato-0.0.6...couchpotato-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [couchpotato-0.0.6](https://github.com/truecharts/apps/compare/couchpotato-0.0.5...couchpotato-0.0.6) (2021-12-19) diff --git a/charts/stable/couchpotato/README.md b/charts/stable/couchpotato/README.md index ba3edd49bab..aa4bd53e248 100644 --- a/charts/stable/couchpotato/README.md +++ b/charts/stable/couchpotato/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/couchpotato/security.md b/charts/stable/couchpotato/security.md index 6847214e153..e1d2f9ff42f 100644 --- a/charts/stable/couchpotato/security.md +++ b/charts/stable/couchpotato/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/cryptofolio/CHANGELOG.md b/charts/stable/cryptofolio/CHANGELOG.md index 65cdbf36766..f14bfc99881 100644 --- a/charts/stable/cryptofolio/CHANGELOG.md +++ b/charts/stable/cryptofolio/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [cryptofolio-2.0.26](https://github.com/truecharts/apps/compare/cryptofolio-2.0.25...cryptofolio-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [cryptofolio-2.0.25](https://github.com/truecharts/apps/compare/cryptofolio-2.0.24...cryptofolio-2.0.25) (2021-12-19) diff --git a/charts/stable/cryptofolio/README.md b/charts/stable/cryptofolio/README.md index be04f1e664b..4078490dc95 100644 --- a/charts/stable/cryptofolio/README.md +++ b/charts/stable/cryptofolio/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/cryptofolio/security.md b/charts/stable/cryptofolio/security.md index ed2c9a28791..09a71f45f9a 100644 --- a/charts/stable/cryptofolio/security.md +++ b/charts/stable/cryptofolio/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,6 +82,8 @@ hide: | apache2 | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -98,6 +96,8 @@ hide: | apache2-bin | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -110,6 +110,8 @@ hide: | apache2-data | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -122,6 +124,8 @@ hide: | apache2-utils | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -359,7 +363,7 @@ hide: | linux-libc-dev | CVE-2021-40490 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| | linux-libc-dev | CVE-2021-41073 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...http://www.openwall.com/lists/oss-security/2021/09/18/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41073
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J7KSMIOQ4377CVTHMWNGNCWHMCRFRP2T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAP4TXEZ7J4EZQMQW5SIJMWXG7WZT3F7/
https://security.netapp.com/advisory/ntap-20211014-0003/
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://www.debian.org/security/2021/dsa-4978
https://www.openwall.com/lists/oss-security/2021/09/18/2
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-4 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -375,9 +379,9 @@ hide: | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-4 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| | linux-libc-dev | CVE-2020-3702 | MEDIUM | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/linux-wireless/CABvG-CVvPF++0vuGzCrBj8+s=Bcx1GwWfiW1_Somu_GVncTAcQ@mail.gmail.com/
https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#mf8b430d4f19f1b939a29b6c5098fdc514fd1a928
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.arista.com/en/support/advisories-notices/security-advisories/11998-security-advisory-58
https://www.debian.org/security/2021/dsa-4978
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -394,15 +398,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-4 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-4 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-4 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-4 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-4 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -448,7 +454,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-4 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| diff --git a/charts/stable/custom-app/CHANGELOG.md b/charts/stable/custom-app/CHANGELOG.md index 277058a0ac9..63e0b3d3a53 100644 --- a/charts/stable/custom-app/CHANGELOG.md +++ b/charts/stable/custom-app/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [custom-app-3.0.45](https://github.com/truecharts/apps/compare/custom-app-3.0.44...custom-app-3.0.45) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [custom-app-3.0.44](https://github.com/truecharts/apps/compare/custom-app-3.0.43...custom-app-3.0.44) (2021-12-20) diff --git a/charts/stable/custom-app/README.md b/charts/stable/custom-app/README.md index f77b0fddf3b..03e0d626d24 100644 --- a/charts/stable/custom-app/README.md +++ b/charts/stable/custom-app/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/custom-app/helm-values.md b/charts/stable/custom-app/helm-values.md index c95b9971857..614626d5c52 100644 --- a/charts/stable/custom-app/helm-values.md +++ b/charts/stable/custom-app/helm-values.md @@ -13,6 +13,6 @@ You will, however, be able to use all values referenced in the common chart here |-----|------|---------|-------------| | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/jackett"` | | -| image.tag | string | `"v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f"` | | +| image.tag | string | `"v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2"` | | All Rights Reserved - The TrueCharts Project diff --git a/charts/stable/custom-app/security.md b/charts/stable/custom-app/security.md index be2b9e151ac..7190f759d18 100644 --- a/charts/stable/custom-app/security.md +++ b/charts/stable/custom-app/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-custom-app' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f + tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f (ubuntu 20.04) +#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 (ubuntu 20.04) **ubuntu** @@ -153,4 +150,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/darktable/CHANGELOG.md b/charts/stable/darktable/CHANGELOG.md index d0dd82625f9..d31c11ba978 100644 --- a/charts/stable/darktable/CHANGELOG.md +++ b/charts/stable/darktable/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [darktable-0.0.7](https://github.com/truecharts/apps/compare/darktable-0.0.6...darktable-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [darktable-0.0.6](https://github.com/truecharts/apps/compare/darktable-0.0.5...darktable-0.0.6) (2021-12-19) diff --git a/charts/stable/darktable/README.md b/charts/stable/darktable/README.md index e99ade74b34..b3a4dd986eb 100644 --- a/charts/stable/darktable/README.md +++ b/charts/stable/darktable/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/darktable/security.md b/charts/stable/darktable/security.md index e0b135f4d51..751022b75e9 100644 --- a/charts/stable/darktable/security.md +++ b/charts/stable/darktable/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/davos/CHANGELOG.md b/charts/stable/davos/CHANGELOG.md index c82c3ae334e..7741b28f533 100644 --- a/charts/stable/davos/CHANGELOG.md +++ b/charts/stable/davos/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [davos-2.0.26](https://github.com/truecharts/apps/compare/davos-2.0.25...davos-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [davos-2.0.25](https://github.com/truecharts/apps/compare/davos-2.0.24...davos-2.0.25) (2021-12-19) diff --git a/charts/stable/davos/README.md b/charts/stable/davos/README.md index e646caeb72d..f7c15319c4f 100644 --- a/charts/stable/davos/README.md +++ b/charts/stable/davos/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/davos/security.md b/charts/stable/davos/security.md index 56b7d9d9396..227a5f7064b 100644 --- a/charts/stable/davos/security.md +++ b/charts/stable/davos/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -139,13 +135,13 @@ hide: | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.4 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.2 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.4.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.logging.log4j:log4j-core | CVE-2017-5645 | CRITICAL | 2.4.1 | 2.8.2 |
Expand...http://www.openwall.com/lists/oss-security/2019/12/19/2
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/97702
http://www.securitytracker.com/id/1040200
http://www.securitytracker.com/id/1041294
https://access.redhat.com/errata/RHSA-2017:1417
https://access.redhat.com/errata/RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:1802
https://access.redhat.com/errata/RHSA-2017:2423
https://access.redhat.com/errata/RHSA-2017:2633
https://access.redhat.com/errata/RHSA-2017:2635
https://access.redhat.com/errata/RHSA-2017:2636
https://access.redhat.com/errata/RHSA-2017:2637
https://access.redhat.com/errata/RHSA-2017:2638
https://access.redhat.com/errata/RHSA-2017:2808
https://access.redhat.com/errata/RHSA-2017:2809
https://access.redhat.com/errata/RHSA-2017:2810
https://access.redhat.com/errata/RHSA-2017:2811
https://access.redhat.com/errata/RHSA-2017:2888
https://access.redhat.com/errata/RHSA-2017:2889
https://access.redhat.com/errata/RHSA-2017:3244
https://access.redhat.com/errata/RHSA-2017:3399
https://access.redhat.com/errata/RHSA-2017:3400
https://access.redhat.com/errata/RHSA-2019:1545
https://github.com/advisories/GHSA-fxph-q3j8-mv87
https://issues.apache.org/jira/browse/LOG4J2-1863
https://linux.oracle.com/cve/CVE-2017-5645.html
https://linux.oracle.com/errata/ELSA-2017-2423.html
https://lists.apache.org/thread.html/0dcca05274d20ef2d72584edcf8c917bbb13dbbd7eb35cae909d02e9@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/r0831e2e52a390758ce39a6193f82c11c295175adce6e6307de28c287@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r23369fd603eb6d62d3b883a0a28d12052dcbd1d6d531137124cd7f83@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d@%3Ccommits.logging.apache.org%3E
https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422@%3Ccommits.doris.apache.org%3E
https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rdbd579dc223f06af826d7de340218ee2f80d8b43fa7e4decb2a63f44@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5645
https://security.netapp.com/advisory/ntap-20180726-0002/
https://security.netapp.com/advisory/ntap-20181107-0002/
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.logging.log4j:log4j-core | CVE-2021-44228 | CRITICAL | 2.4.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-core | CVE-2020-9488 | LOW | 2.4.1 | 2.13.2 |
Expand...https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45046 | LOW | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45046 | CRITICAL | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-core | CVE-2020-9488 | LOW | 2.4.1 | 2.13.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9488
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b (release-2.x)
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=fb91a3d71e2f3dadad6fd1beb2ab857f44fe8bbb (master)
https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.openwall.com/lists/oss-security/2020/04/25/1
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2017-5648 | CRITICAL | 8.5.6 | 7.0.76, 8.0.42, 8.5.12, 9.0.1 |
Expand...http://www.debian.org/security/2017/dsa-3842
http://www.debian.org/security/2017/dsa-3843
http://www.openwall.com/lists/oss-security/2017/04/10/23
http://www.openwall.com/lists/oss-security/2020/07/20/8
http://www.securityfocus.com/bid/97530
http://www.securitytracker.com/id/1038220
https://access.redhat.com/errata/RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:1802
https://access.redhat.com/errata/RHSA-2017:1809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5648
https://linux.oracle.com/cve/CVE-2017-5648.html
https://linux.oracle.com/errata/ELSA-2017-1809.html
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5648
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20180614-0001/
https://ubuntu.com/security/notices/USN-3519-1
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2017-5651 | CRITICAL | 8.5.6 | 8.5.13, 9.0.1 |
Expand...http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.securityfocus.com/bid/97544
http://www.securitytracker.com/id/1038219
https://bz.apache.org/bugzilla/show_bug.cgi?id=60918
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5651
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20180614-0001/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2018-8014 | CRITICAL | 8.5.6 | 7.0.88, 8.0.53, 8.5.32, 9.0.9 |
Expand...http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
http://tomcat.apache.org/security-9.html
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/104203
http://www.securitytracker.com/id/1040998
http://www.securitytracker.com/id/1041888
https://access.redhat.com/errata/RHSA-2018:2469
https://access.redhat.com/errata/RHSA-2018:2470
https://access.redhat.com/errata/RHSA-2018:3768
https://access.redhat.com/errata/RHSA-2019:0450
https://access.redhat.com/errata/RHSA-2019:0451
https://access.redhat.com/errata/RHSA-2019:1529
https://access.redhat.com/errata/RHSA-2019:2205
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
https://linux.oracle.com/cve/CVE-2018-8014.html
https://linux.oracle.com/errata/ELSA-2019-2205.html
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
https://nvd.nist.gov/vuln/detail/CVE-2018-8014
https://seclists.org/bugtraq/2019/Dec/43
https://security.netapp.com/advisory/ntap-20181018-0002/
https://ubuntu.com/security/notices/USN-3665-1
https://usn.ubuntu.com/3665-1/
https://www.debian.org/security/2019/dsa-4596
https://www.oracle.com/security-alerts/cpuapr2020.html
| diff --git a/charts/stable/ddclient/CHANGELOG.md b/charts/stable/ddclient/CHANGELOG.md index 33b5daf5cdb..c5ccb9c61b8 100644 --- a/charts/stable/ddclient/CHANGELOG.md +++ b/charts/stable/ddclient/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ddclient-0.0.7](https://github.com/truecharts/apps/compare/ddclient-0.0.6...ddclient-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ddclient-0.0.6](https://github.com/truecharts/apps/compare/ddclient-0.0.5...ddclient-0.0.6) (2021-12-19) diff --git a/charts/stable/ddclient/README.md b/charts/stable/ddclient/README.md index db1ec4122fb..12bfe4844ce 100644 --- a/charts/stable/ddclient/README.md +++ b/charts/stable/ddclient/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/ddclient/security.md b/charts/stable/ddclient/security.md index 0976da47ab9..ef53390b360 100644 --- a/charts/stable/ddclient/security.md +++ b/charts/stable/ddclient/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/deconz/CHANGELOG.md b/charts/stable/deconz/CHANGELOG.md index e7862750906..07ff2d25085 100644 --- a/charts/stable/deconz/CHANGELOG.md +++ b/charts/stable/deconz/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deconz-6.0.7](https://github.com/truecharts/apps/compare/deconz-6.0.6...deconz-6.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deconz-6.0.6](https://github.com/truecharts/apps/compare/deconz-6.0.5...deconz-6.0.6) (2021-12-19) diff --git a/charts/stable/deconz/README.md b/charts/stable/deconz/README.md index f047e799d79..add032eeb44 100644 --- a/charts/stable/deconz/README.md +++ b/charts/stable/deconz/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/deconz/security.md b/charts/stable/deconz/security.md index 0e0c040a265..ad13d53eaa1 100644 --- a/charts/stable/deconz/security.md +++ b/charts/stable/deconz/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/deepstack-cpu/CHANGELOG.md b/charts/stable/deepstack-cpu/CHANGELOG.md index 9b5f7b745b8..f632b0bf8e5 100644 --- a/charts/stable/deepstack-cpu/CHANGELOG.md +++ b/charts/stable/deepstack-cpu/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deepstack-cpu-8.0.8](https://github.com/truecharts/apps/compare/deepstack-cpu-8.0.7...deepstack-cpu-8.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deepstack-cpu-8.0.7](https://github.com/truecharts/apps/compare/deepstack-cpu-8.0.6...deepstack-cpu-8.0.7) (2021-12-19) diff --git a/charts/stable/deepstack-cpu/README.md b/charts/stable/deepstack-cpu/README.md index 8bf1a780989..4feb103153f 100644 --- a/charts/stable/deepstack-cpu/README.md +++ b/charts/stable/deepstack-cpu/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/deepstack-cpu/security.md b/charts/stable/deepstack-cpu/security.md index 455cc9497c3..4614676a606 100644 --- a/charts/stable/deepstack-cpu/security.md +++ b/charts/stable/deepstack-cpu/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -2715,7 +2711,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-40490 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.152-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -2760,13 +2756,13 @@ hide: | linux-libc-dev | CVE-2020-4788 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...http://www.openwall.com/lists/oss-security/2020/11/20/3
http://www.openwall.com/lists/oss-security/2020/11/23/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788
https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dda3f4252e6c8b833a2ef164afd3da9808d0f07c
https://linux.oracle.com/cve/CVE-2020-4788.html
https://linux.oracle.com/errata/ELSA-2021-9308.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc
https://ubuntu.com/security/notices/USN-4657-1
https://ubuntu.com/security/notices/USN-4658-1
https://ubuntu.com/security/notices/USN-4659-1
https://ubuntu.com/security/notices/USN-4660-1
https://ubuntu.com/security/notices/USN-4681-1
https://www.ibm.com/support/pages/node/6370729
https://www.openwall.com/lists/oss-security/2020/11/20/3
| | linux-libc-dev | CVE-2020-8694 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694
https://linux.oracle.com/cve/CVE-2020-8694.html
https://linux.oracle.com/errata/ELSA-2020-5996.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
https://platypusattack.com/
https://ubuntu.com/security/notices/USN-4626-1
https://ubuntu.com/security/notices/USN-4627-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html
| | linux-libc-dev | CVE-2021-0129 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0129
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=00da0fb4972cf59e1c075f313da81ea549cb8738
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f
https://linux.oracle.com/cve/CVE-2021-0129.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
https://security.netapp.com/advisory/ntap-20210716-0002/
https://ubuntu.com/security/notices/USN-5017-1
https://ubuntu.com/security/notices/USN-5018-1
https://ubuntu.com/security/notices/USN-5046-1
https://ubuntu.com/security/notices/USN-5050-1
https://www.debian.org/security/2021/dsa-4951
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-0937 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0937
https://git.kernel.org/linus/b29c457a6511435960115c0f548c4360d5f4801d
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-0941 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://android.googlesource.com/kernel/common/+/6306c1189e77a513bf02720450bb43bd4ba5d8ae%5E%21/#F0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0941
https://git.kernel.org/6306c1189e77a513bf02720450bb43bd4ba5d8ae
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-20177 | MEDIUM | 4.19.152-1 | 4.19.171-2 |
Expand...https://bugzilla.kernel.org/show_bug.cgi?id=209823
https://bugzilla.redhat.com/show_bug.cgi?id=1914719
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20177
https://linux.oracle.com/cve/CVE-2021-20177.html
https://linux.oracle.com/errata/ELSA-2021-9038.html
https://ubuntu.com/security/notices/USN-4750-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.152-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-26931 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-362.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26931
https://linux.oracle.com/cve/CVE-2021-26931.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://ubuntu.com/security/notices/USN-4904-1
https://ubuntu.com/security/notices/USN-4909-1
https://ubuntu.com/security/notices/USN-4946-1
https://ubuntu.com/security/notices/USN-4949-1
https://www.openwall.com/lists/oss-security/2021/02/16/4
https://xenbits.xen.org/xsa/advisory-362.html
| | linux-libc-dev | CVE-2021-26932 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-361.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932
https://linux.oracle.com/cve/CVE-2021-26932.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/3
https://xenbits.xen.org/xsa/advisory-361.html
| | linux-libc-dev | CVE-2021-27363 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
http://www.openwall.com/lists/oss-security/2021/03/06/1
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
https://bugzilla.suse.com/show_bug.cgi?id=1182716
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
https://git.kernel.org/linus/688e8128b7a92df982709a4137ea4588d16f24aa
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
https://linux.oracle.com/cve/CVE-2021-27363.html
https://linux.oracle.com/errata/ELSA-2021-9175.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://security.netapp.com/advisory/ntap-20210409-0001/
https://ubuntu.com/security/notices/USN-4883-1
https://ubuntu.com/security/notices/USN-4887-1
https://ubuntu.com/security/notices/USN-4889-1
https://ubuntu.com/security/notices/USN-4901-1
https://www.openwall.com/lists/oss-security/2021/03/06/1
| @@ -2807,14 +2803,19 @@ hide: | linux-libc-dev | CVE-2021-38199 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38199
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20210902-0010/
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
https://ubuntu.com/security/notices/USN-5136-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-38208 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/08/17/1
http://www.openwall.com/lists/oss-security/2021/08/17/2
http://www.openwall.com/lists/oss-security/2021/08/24/2
https://bugzilla.redhat.com/show_bug.cgi?id=1992810
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38208
https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba
https://ubuntu.com/security/notices/USN-5050-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| +| linux-libc-dev | CVE-2021-39648 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39656 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39657 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.152-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.152-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.152-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.152-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.152-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -2873,10 +2874,11 @@ hide: | linux-libc-dev | CVE-2021-38204 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| | linux-libc-dev | CVE-2021-38209 | LOW | 4.19.152-1 | 4.19.194-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38209
https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6
| -| linux-libc-dev | CVE-2021-39648 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39656 | UNKNOWN | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39657 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.152-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -3046,5 +3048,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| diff --git a/charts/stable/deepstack-gpu/CHANGELOG.md b/charts/stable/deepstack-gpu/CHANGELOG.md index 37ec04e688e..e57673bf082 100644 --- a/charts/stable/deepstack-gpu/CHANGELOG.md +++ b/charts/stable/deepstack-gpu/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deepstack-gpu-3.0.8](https://github.com/truecharts/apps/compare/deepstack-gpu-3.0.7...deepstack-gpu-3.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deepstack-gpu-3.0.7](https://github.com/truecharts/apps/compare/deepstack-gpu-3.0.6...deepstack-gpu-3.0.7) (2021-12-19) diff --git a/charts/stable/deepstack-gpu/README.md b/charts/stable/deepstack-gpu/README.md index 8bf1a780989..4feb103153f 100644 --- a/charts/stable/deepstack-gpu/README.md +++ b/charts/stable/deepstack-gpu/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/deepstack-gpu/security.md b/charts/stable/deepstack-gpu/security.md index 6f767d2c697..eeab83a9ae1 100644 --- a/charts/stable/deepstack-gpu/security.md +++ b/charts/stable/deepstack-gpu/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -2715,7 +2711,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-40490 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.152-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -2760,13 +2756,13 @@ hide: | linux-libc-dev | CVE-2020-4788 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...http://www.openwall.com/lists/oss-security/2020/11/20/3
http://www.openwall.com/lists/oss-security/2020/11/23/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788
https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dda3f4252e6c8b833a2ef164afd3da9808d0f07c
https://linux.oracle.com/cve/CVE-2020-4788.html
https://linux.oracle.com/errata/ELSA-2021-9308.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc
https://ubuntu.com/security/notices/USN-4657-1
https://ubuntu.com/security/notices/USN-4658-1
https://ubuntu.com/security/notices/USN-4659-1
https://ubuntu.com/security/notices/USN-4660-1
https://ubuntu.com/security/notices/USN-4681-1
https://www.ibm.com/support/pages/node/6370729
https://www.openwall.com/lists/oss-security/2020/11/20/3
| | linux-libc-dev | CVE-2020-8694 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694
https://linux.oracle.com/cve/CVE-2020-8694.html
https://linux.oracle.com/errata/ELSA-2020-5996.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
https://platypusattack.com/
https://ubuntu.com/security/notices/USN-4626-1
https://ubuntu.com/security/notices/USN-4627-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html
| | linux-libc-dev | CVE-2021-0129 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0129
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=00da0fb4972cf59e1c075f313da81ea549cb8738
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f
https://linux.oracle.com/cve/CVE-2021-0129.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
https://security.netapp.com/advisory/ntap-20210716-0002/
https://ubuntu.com/security/notices/USN-5017-1
https://ubuntu.com/security/notices/USN-5018-1
https://ubuntu.com/security/notices/USN-5046-1
https://ubuntu.com/security/notices/USN-5050-1
https://www.debian.org/security/2021/dsa-4951
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-0937 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0937
https://git.kernel.org/linus/b29c457a6511435960115c0f548c4360d5f4801d
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-0941 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://android.googlesource.com/kernel/common/+/6306c1189e77a513bf02720450bb43bd4ba5d8ae%5E%21/#F0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0941
https://git.kernel.org/6306c1189e77a513bf02720450bb43bd4ba5d8ae
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-20177 | MEDIUM | 4.19.152-1 | 4.19.171-2 |
Expand...https://bugzilla.kernel.org/show_bug.cgi?id=209823
https://bugzilla.redhat.com/show_bug.cgi?id=1914719
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20177
https://linux.oracle.com/cve/CVE-2021-20177.html
https://linux.oracle.com/errata/ELSA-2021-9038.html
https://ubuntu.com/security/notices/USN-4750-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.152-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-26931 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-362.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26931
https://linux.oracle.com/cve/CVE-2021-26931.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://ubuntu.com/security/notices/USN-4904-1
https://ubuntu.com/security/notices/USN-4909-1
https://ubuntu.com/security/notices/USN-4946-1
https://ubuntu.com/security/notices/USN-4949-1
https://www.openwall.com/lists/oss-security/2021/02/16/4
https://xenbits.xen.org/xsa/advisory-362.html
| | linux-libc-dev | CVE-2021-26932 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-361.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932
https://linux.oracle.com/cve/CVE-2021-26932.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/3
https://xenbits.xen.org/xsa/advisory-361.html
| | linux-libc-dev | CVE-2021-27363 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
http://www.openwall.com/lists/oss-security/2021/03/06/1
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
https://bugzilla.suse.com/show_bug.cgi?id=1182716
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
https://git.kernel.org/linus/688e8128b7a92df982709a4137ea4588d16f24aa
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
https://linux.oracle.com/cve/CVE-2021-27363.html
https://linux.oracle.com/errata/ELSA-2021-9175.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://security.netapp.com/advisory/ntap-20210409-0001/
https://ubuntu.com/security/notices/USN-4883-1
https://ubuntu.com/security/notices/USN-4887-1
https://ubuntu.com/security/notices/USN-4889-1
https://ubuntu.com/security/notices/USN-4901-1
https://www.openwall.com/lists/oss-security/2021/03/06/1
| @@ -2807,14 +2803,19 @@ hide: | linux-libc-dev | CVE-2021-38199 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38199
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20210902-0010/
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
https://ubuntu.com/security/notices/USN-5136-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-38208 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/08/17/1
http://www.openwall.com/lists/oss-security/2021/08/17/2
http://www.openwall.com/lists/oss-security/2021/08/24/2
https://bugzilla.redhat.com/show_bug.cgi?id=1992810
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38208
https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba
https://ubuntu.com/security/notices/USN-5050-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| +| linux-libc-dev | CVE-2021-39648 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39656 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39657 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.152-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.152-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.152-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.152-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.152-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -2873,10 +2874,11 @@ hide: | linux-libc-dev | CVE-2021-38204 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| | linux-libc-dev | CVE-2021-38209 | LOW | 4.19.152-1 | 4.19.194-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38209
https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6
| -| linux-libc-dev | CVE-2021-39648 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39656 | UNKNOWN | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39657 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.152-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -3046,5 +3048,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| diff --git a/charts/stable/deluge/CHANGELOG.md b/charts/stable/deluge/CHANGELOG.md index ab9872cc902..d0f191f4f4e 100644 --- a/charts/stable/deluge/CHANGELOG.md +++ b/charts/stable/deluge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deluge-9.0.27](https://github.com/truecharts/apps/compare/deluge-9.0.26...deluge-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deluge-9.0.26](https://github.com/truecharts/apps/compare/deluge-9.0.25...deluge-9.0.26) (2021-12-19) diff --git a/charts/stable/deluge/README.md b/charts/stable/deluge/README.md index 6c9e2bf68a9..6d3b83acab8 100644 --- a/charts/stable/deluge/README.md +++ b/charts/stable/deluge/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/deluge/security.md b/charts/stable/deluge/security.md index 1bb01b39166..805db64cc25 100644 --- a/charts/stable/deluge/security.md +++ b/charts/stable/deluge/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/digikam/CHANGELOG.md b/charts/stable/digikam/CHANGELOG.md index c438b0a7140..2255224d11b 100644 --- a/charts/stable/digikam/CHANGELOG.md +++ b/charts/stable/digikam/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [digikam-2.0.28](https://github.com/truecharts/apps/compare/digikam-2.0.27...digikam-2.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [digikam-2.0.27](https://github.com/truecharts/apps/compare/digikam-2.0.26...digikam-2.0.27) (2021-12-19) diff --git a/charts/stable/digikam/README.md b/charts/stable/digikam/README.md index 7d5fca49977..e038fe84acc 100644 --- a/charts/stable/digikam/README.md +++ b/charts/stable/digikam/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/digikam/security.md b/charts/stable/digikam/security.md index dfb74589fad..3db6fb78b5c 100644 --- a/charts/stable/digikam/security.md +++ b/charts/stable/digikam/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -309,3 +305,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/dillinger/CHANGELOG.md b/charts/stable/dillinger/CHANGELOG.md index 5bf7dc51e1f..2944ab58c23 100644 --- a/charts/stable/dillinger/CHANGELOG.md +++ b/charts/stable/dillinger/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dillinger-0.0.7](https://github.com/truecharts/apps/compare/dillinger-0.0.6...dillinger-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dillinger-0.0.6](https://github.com/truecharts/apps/compare/dillinger-0.0.5...dillinger-0.0.6) (2021-12-19) diff --git a/charts/stable/dillinger/README.md b/charts/stable/dillinger/README.md index 290da6eb1c8..93ba85b1f84 100644 --- a/charts/stable/dillinger/README.md +++ b/charts/stable/dillinger/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/dillinger/security.md b/charts/stable/dillinger/security.md index 400bc093ebd..cd0b749263b 100644 --- a/charts/stable/dillinger/security.md +++ b/charts/stable/dillinger/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/dizquetv/CHANGELOG.md b/charts/stable/dizquetv/CHANGELOG.md index 04727893adb..f6bf1a9c3d9 100644 --- a/charts/stable/dizquetv/CHANGELOG.md +++ b/charts/stable/dizquetv/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dizquetv-5.0.7](https://github.com/truecharts/apps/compare/dizquetv-5.0.6...dizquetv-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dizquetv-5.0.6](https://github.com/truecharts/apps/compare/dizquetv-5.0.5...dizquetv-5.0.6) (2021-12-19) diff --git a/charts/stable/dizquetv/README.md b/charts/stable/dizquetv/README.md index 3056295c0f7..2e16fc399c5 100644 --- a/charts/stable/dizquetv/README.md +++ b/charts/stable/dizquetv/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/dizquetv/security.md b/charts/stable/dizquetv/security.md index 0265ebe4149..174e6ba9dfc 100644 --- a/charts/stable/dizquetv/security.md +++ b/charts/stable/dizquetv/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-dizquetv' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/dokuwiki/CHANGELOG.md b/charts/stable/dokuwiki/CHANGELOG.md index 8037dc9751e..c8215165cc9 100644 --- a/charts/stable/dokuwiki/CHANGELOG.md +++ b/charts/stable/dokuwiki/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dokuwiki-0.0.7](https://github.com/truecharts/apps/compare/dokuwiki-0.0.6...dokuwiki-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dokuwiki-0.0.6](https://github.com/truecharts/apps/compare/dokuwiki-0.0.5...dokuwiki-0.0.6) (2021-12-19) diff --git a/charts/stable/dokuwiki/README.md b/charts/stable/dokuwiki/README.md index 6418bbb34e5..1328f8caa80 100644 --- a/charts/stable/dokuwiki/README.md +++ b/charts/stable/dokuwiki/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/dokuwiki/security.md b/charts/stable/dokuwiki/security.md index 2d7fb428132..306c98642b3 100644 --- a/charts/stable/dokuwiki/security.md +++ b/charts/stable/dokuwiki/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/domoticz/CHANGELOG.md b/charts/stable/domoticz/CHANGELOG.md index f1da698e866..ec74dbe9b08 100644 --- a/charts/stable/domoticz/CHANGELOG.md +++ b/charts/stable/domoticz/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [domoticz-0.0.9](https://github.com/truecharts/apps/compare/domoticz-0.0.8...domoticz-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [domoticz-0.0.8](https://github.com/truecharts/apps/compare/domoticz-0.0.7...domoticz-0.0.8) (2021-12-19) diff --git a/charts/stable/domoticz/README.md b/charts/stable/domoticz/README.md index 58c5899bdf7..c9e6dd54d5e 100644 --- a/charts/stable/domoticz/README.md +++ b/charts/stable/domoticz/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/domoticz/security.md b/charts/stable/domoticz/security.md index 0b371343a8d..24308923ec4 100644 --- a/charts/stable/domoticz/security.md +++ b/charts/stable/domoticz/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/doublecommander/CHANGELOG.md b/charts/stable/doublecommander/CHANGELOG.md index 275521d7b95..aa0294c9129 100644 --- a/charts/stable/doublecommander/CHANGELOG.md +++ b/charts/stable/doublecommander/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [doublecommander-2.0.29](https://github.com/truecharts/apps/compare/doublecommander-2.0.28...doublecommander-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [doublecommander-2.0.28](https://github.com/truecharts/apps/compare/doublecommander-2.0.27...doublecommander-2.0.28) (2021-12-19) diff --git a/charts/stable/doublecommander/README.md b/charts/stable/doublecommander/README.md index 24c2dfe55ad..bd5b82f1caa 100644 --- a/charts/stable/doublecommander/README.md +++ b/charts/stable/doublecommander/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/doublecommander/security.md b/charts/stable/doublecommander/security.md index ce7cfcffac4..240b19663c8 100644 --- a/charts/stable/doublecommander/security.md +++ b/charts/stable/doublecommander/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -328,3 +324,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/dsmr-reader/CHANGELOG.md b/charts/stable/dsmr-reader/CHANGELOG.md index c8ad230adb6..759ee6342e1 100644 --- a/charts/stable/dsmr-reader/CHANGELOG.md +++ b/charts/stable/dsmr-reader/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dsmr-reader-5.0.16](https://github.com/truecharts/apps/compare/dsmr-reader-5.0.15...dsmr-reader-5.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dsmr-reader-5.0.15](https://github.com/truecharts/apps/compare/dsmr-reader-5.0.14...dsmr-reader-5.0.15) (2021-12-19) diff --git a/charts/stable/dsmr-reader/README.md b/charts/stable/dsmr-reader/README.md index 350ba2c0770..5409310b20e 100644 --- a/charts/stable/dsmr-reader/README.md +++ b/charts/stable/dsmr-reader/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/dsmr-reader/security.md b/charts/stable/dsmr-reader/security.md index 274a4847b5f..4868b66c660 100644 --- a/charts/stable/dsmr-reader/security.md +++ b/charts/stable/dsmr-reader/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/dsmr-reader:v2021.09.02@sha256:bf3454b0b379d325d95ec0693e2634bcfd4bfd917ec59d0918ca60d32a6073c5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -394,7 +384,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/duckdns/CHANGELOG.md b/charts/stable/duckdns/CHANGELOG.md index 34b58d6c739..4381a097a97 100644 --- a/charts/stable/duckdns/CHANGELOG.md +++ b/charts/stable/duckdns/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [duckdns-0.0.7](https://github.com/truecharts/apps/compare/duckdns-0.0.6...duckdns-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [duckdns-0.0.6](https://github.com/truecharts/apps/compare/duckdns-0.0.5...duckdns-0.0.6) (2021-12-19) diff --git a/charts/stable/duckdns/README.md b/charts/stable/duckdns/README.md index 14940da5295..6534ac18235 100644 --- a/charts/stable/duckdns/README.md +++ b/charts/stable/duckdns/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/duckdns/security.md b/charts/stable/duckdns/security.md index def4eb514d0..f1acc1fabb5 100644 --- a/charts/stable/duckdns/security.md +++ b/charts/stable/duckdns/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/duplicati/CHANGELOG.md b/charts/stable/duplicati/CHANGELOG.md index d5ee9592cf3..be679cd5d5a 100644 --- a/charts/stable/duplicati/CHANGELOG.md +++ b/charts/stable/duplicati/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [duplicati-4.0.26](https://github.com/truecharts/apps/compare/duplicati-4.0.25...duplicati-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [duplicati-4.0.25](https://github.com/truecharts/apps/compare/duplicati-4.0.24...duplicati-4.0.25) (2021-12-19) diff --git a/charts/stable/duplicati/README.md b/charts/stable/duplicati/README.md index 1fb770f60b5..f08349c043f 100644 --- a/charts/stable/duplicati/README.md +++ b/charts/stable/duplicati/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/duplicati/security.md b/charts/stable/duplicati/security.md index 13d21cffa4e..02530d23bd1 100644 --- a/charts/stable/duplicati/security.md +++ b/charts/stable/duplicati/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-duplicati' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/emby/CHANGELOG.md b/charts/stable/emby/CHANGELOG.md index 50022e2ddb8..8e780db57d4 100644 --- a/charts/stable/emby/CHANGELOG.md +++ b/charts/stable/emby/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [emby-9.0.28](https://github.com/truecharts/apps/compare/emby-9.0.27...emby-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [emby-9.0.27](https://github.com/truecharts/apps/compare/embystat-0.0.5...emby-9.0.27) (2021-12-19) diff --git a/charts/stable/emby/README.md b/charts/stable/emby/README.md index b4ddc8f7414..f78a31c9594 100644 --- a/charts/stable/emby/README.md +++ b/charts/stable/emby/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/emby/security.md b/charts/stable/emby/security.md index b2854808384..cb31e6a9d99 100644 --- a/charts/stable/emby/security.md +++ b/charts/stable/emby/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-emby' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -163,4 +160,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/embystat/CHANGELOG.md b/charts/stable/embystat/CHANGELOG.md index 591a11d7f1a..219352df417 100644 --- a/charts/stable/embystat/CHANGELOG.md +++ b/charts/stable/embystat/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [embystat-0.0.7](https://github.com/truecharts/apps/compare/embystat-0.0.6...embystat-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [embystat-0.0.6](https://github.com/truecharts/apps/compare/embystat-0.0.5...embystat-0.0.6) (2021-12-19) diff --git a/charts/stable/embystat/README.md b/charts/stable/embystat/README.md index 81497bb37be..6b3d88616ab 100644 --- a/charts/stable/embystat/README.md +++ b/charts/stable/embystat/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/embystat/security.md b/charts/stable/embystat/security.md index 79870bf4b54..ee24b1de313 100644 --- a/charts/stable/embystat/security.md +++ b/charts/stable/embystat/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/emulatorjs/CHANGELOG.md b/charts/stable/emulatorjs/CHANGELOG.md index 4850119cdb0..3e70518cc7a 100644 --- a/charts/stable/emulatorjs/CHANGELOG.md +++ b/charts/stable/emulatorjs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [emulatorjs-0.0.9](https://github.com/truecharts/apps/compare/emulatorjs-0.0.8...emulatorjs-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [emulatorjs-0.0.8](https://github.com/truecharts/apps/compare/emulatorjs-0.0.7...emulatorjs-0.0.8) (2021-12-20) diff --git a/charts/stable/emulatorjs/README.md b/charts/stable/emulatorjs/README.md index f92023ef8de..7f667739afb 100644 --- a/charts/stable/emulatorjs/README.md +++ b/charts/stable/emulatorjs/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/emulatorjs/security.md b/charts/stable/emulatorjs/security.md index 9d8360fcee3..4738e47a3ef 100644 --- a/charts/stable/emulatorjs/security.md +++ b/charts/stable/emulatorjs/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -87,5 +84,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/charts/stable/endlessh/CHANGELOG.md b/charts/stable/endlessh/CHANGELOG.md index 409175859e4..66a62d0e9a3 100644 --- a/charts/stable/endlessh/CHANGELOG.md +++ b/charts/stable/endlessh/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [endlessh-0.0.7](https://github.com/truecharts/apps/compare/endlessh-0.0.6...endlessh-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [endlessh-0.0.6](https://github.com/truecharts/apps/compare/endlessh-0.0.5...endlessh-0.0.6) (2021-12-19) diff --git a/charts/stable/endlessh/README.md b/charts/stable/endlessh/README.md index 7b503c90d5d..b9f63eb7ead 100644 --- a/charts/stable/endlessh/README.md +++ b/charts/stable/endlessh/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/endlessh/security.md b/charts/stable/endlessh/security.md index 72d65450420..7fd043989a5 100644 --- a/charts/stable/endlessh/security.md +++ b/charts/stable/endlessh/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/esphome/CHANGELOG.md b/charts/stable/esphome/CHANGELOG.md index 85dc904417d..3ce78a3fcd8 100644 --- a/charts/stable/esphome/CHANGELOG.md +++ b/charts/stable/esphome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [esphome-9.0.31](https://github.com/truecharts/apps/compare/esphome-9.0.30...esphome-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [esphome-9.0.30](https://github.com/truecharts/apps/compare/esphome-9.0.29...esphome-9.0.30) (2021-12-19) diff --git a/charts/stable/esphome/README.md b/charts/stable/esphome/README.md index cd74079cea3..4051e002e8c 100644 --- a/charts/stable/esphome/README.md +++ b/charts/stable/esphome/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/esphome/security.md b/charts/stable/esphome/security.md index 72108945c41..a4df21bffb3 100644 --- a/charts/stable/esphome/security.md +++ b/charts/stable/esphome/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-esphome' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/etherpad/CHANGELOG.md b/charts/stable/etherpad/CHANGELOG.md index 0fee3d5f2b3..8a830c4ebd2 100644 --- a/charts/stable/etherpad/CHANGELOG.md +++ b/charts/stable/etherpad/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [etherpad-5.0.17](https://github.com/truecharts/apps/compare/etherpad-5.0.16...etherpad-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [etherpad-5.0.16](https://github.com/truecharts/apps/compare/etherpad-5.0.15...etherpad-5.0.16) (2021-12-19) diff --git a/charts/stable/etherpad/README.md b/charts/stable/etherpad/README.md index f7db4a3b3e0..02c02c83b08 100644 --- a/charts/stable/etherpad/README.md +++ b/charts/stable/etherpad/README.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/etherpad/security.md b/charts/stable/etherpad/security.md index de2df2afea6..b4a3f4b8673 100644 --- a/charts/stable/etherpad/security.md +++ b/charts/stable/etherpad/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/etherpad:version-1.8.14@sha256:4900f0e787ca22cf93090ae44ecceb5689d4427c739e1eb637a6e3a913161bf8 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -417,7 +407,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/external-service/CHANGELOG.md b/charts/stable/external-service/CHANGELOG.md index 113d5f57a3f..3b6aaba9ac2 100644 --- a/charts/stable/external-service/CHANGELOG.md +++ b/charts/stable/external-service/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [external-service-4.0.25](https://github.com/truecharts/apps/compare/external-service-4.0.24...external-service-4.0.25) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [external-service-4.0.24](https://github.com/truecharts/apps/compare/external-service-4.0.23...external-service-4.0.24) (2021-12-19) diff --git a/charts/stable/external-service/README.md b/charts/stable/external-service/README.md index 14ec5cfbdd1..c15b5dbaf03 100644 --- a/charts/stable/external-service/README.md +++ b/charts/stable/external-service/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/filezilla/CHANGELOG.md b/charts/stable/filezilla/CHANGELOG.md index 78b2cb2dc81..5093e26eb1c 100644 --- a/charts/stable/filezilla/CHANGELOG.md +++ b/charts/stable/filezilla/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [filezilla-2.0.26](https://github.com/truecharts/apps/compare/filezilla-2.0.25...filezilla-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [filezilla-2.0.25](https://github.com/truecharts/apps/compare/filezilla-2.0.24...filezilla-2.0.25) (2021-12-19) diff --git a/charts/stable/filezilla/README.md b/charts/stable/filezilla/README.md index adff63fd98d..048f286edcd 100644 --- a/charts/stable/filezilla/README.md +++ b/charts/stable/filezilla/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/filezilla/security.md b/charts/stable/filezilla/security.md index d1f94876f83..4954ca36b27 100644 --- a/charts/stable/filezilla/security.md +++ b/charts/stable/filezilla/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/fireflyiii/CHANGELOG.md b/charts/stable/fireflyiii/CHANGELOG.md index 74de8f47e63..5a8c8bd5091 100644 --- a/charts/stable/fireflyiii/CHANGELOG.md +++ b/charts/stable/fireflyiii/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fireflyiii-13.1.8](https://github.com/truecharts/apps/compare/fireflyiii-13.1.7...fireflyiii-13.1.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fireflyiii-13.1.7](https://github.com/truecharts/apps/compare/fireflyiii-13.1.6...fireflyiii-13.1.7) (2021-12-19) diff --git a/charts/stable/fireflyiii/README.md b/charts/stable/fireflyiii/README.md index 3143ad27985..368963bf327 100644 --- a/charts/stable/fireflyiii/README.md +++ b/charts/stable/fireflyiii/README.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/fireflyiii/security.md b/charts/stable/fireflyiii/security.md index 81070e919dd..362dcc4d25e 100644 --- a/charts/stable/fireflyiii/security.md +++ b/charts/stable/fireflyiii/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,17 +48,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -82,13 +66,13 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/fireflyiii-core:v5.6.5@sha256:fe75d9df1daf62871eccb976643ff393ed1bd402b61baa0f17f7ad5289697264 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -125,7 +109,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -351,6 +335,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -361,6 +347,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -371,6 +359,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -381,6 +371,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -901,7 +893,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -920,7 +912,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -930,13 +922,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -983,7 +977,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | locales | CVE-2021-33574 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | locales | CVE-2021-35942 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | locales | CVE-2020-1751 | HIGH | 2.28-10 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751
https://linux.oracle.com/cve/CVE-2020-1751.html
https://linux.oracle.com/errata/ELSA-2020-4444.html
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://ubuntu.com/security/notices/USN-4416-1
https://usn.ubuntu.com/4416-1/
| @@ -1105,7 +1103,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1353,7 +1351,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/firefox-syncserver/CHANGELOG.md b/charts/stable/firefox-syncserver/CHANGELOG.md index 9b5a39ae94b..475852f0943 100644 --- a/charts/stable/firefox-syncserver/CHANGELOG.md +++ b/charts/stable/firefox-syncserver/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [firefox-syncserver-5.0.17](https://github.com/truecharts/apps/compare/firefox-syncserver-5.0.16...firefox-syncserver-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [firefox-syncserver-5.0.16](https://github.com/truecharts/apps/compare/firefox-syncserver-5.0.15...firefox-syncserver-5.0.16) (2021-12-19) diff --git a/charts/stable/firefox-syncserver/README.md b/charts/stable/firefox-syncserver/README.md index 3cf4805b5c9..72fa43e8cd1 100644 --- a/charts/stable/firefox-syncserver/README.md +++ b/charts/stable/firefox-syncserver/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/firefox-syncserver/security.md b/charts/stable/firefox-syncserver/security.md index 9514465a5b3..ef7fd451066 100644 --- a/charts/stable/firefox-syncserver/security.md +++ b/charts/stable/firefox-syncserver/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,15 +36,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -62,10 +52,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/firefox-syncserver:v1.8.0@sha256:d0fbf65c8c7a99ad4ba7ffcfdad2e7b2555e0d829867c21cefc9314ace94f747 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -102,7 +92,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -443,7 +433,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/firefox/CHANGELOG.md b/charts/stable/firefox/CHANGELOG.md index 4de64dbf86a..b46b1a1a26f 100644 --- a/charts/stable/firefox/CHANGELOG.md +++ b/charts/stable/firefox/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [firefox-0.0.7](https://github.com/truecharts/apps/compare/firefox-0.0.6...firefox-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [firefox-0.0.6](https://github.com/truecharts/apps/compare/firefox-0.0.5...firefox-0.0.6) (2021-12-19) diff --git a/charts/stable/firefox/README.md b/charts/stable/firefox/README.md index e1f7c4e9b52..93a5b4453dc 100644 --- a/charts/stable/firefox/README.md +++ b/charts/stable/firefox/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/firefox/security.md b/charts/stable/firefox/security.md index e9be5f9b420..4768a48bbdd 100644 --- a/charts/stable/firefox/security.md +++ b/charts/stable/firefox/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/flaresolverr/CHANGELOG.md b/charts/stable/flaresolverr/CHANGELOG.md index d5668f943e8..72d4ed2bdc0 100644 --- a/charts/stable/flaresolverr/CHANGELOG.md +++ b/charts/stable/flaresolverr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [flaresolverr-4.0.28](https://github.com/truecharts/apps/compare/flaresolverr-4.0.27...flaresolverr-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [flaresolverr-4.0.27](https://github.com/truecharts/apps/compare/flaresolverr-4.0.26...flaresolverr-4.0.27) (2021-12-19) diff --git a/charts/stable/flaresolverr/README.md b/charts/stable/flaresolverr/README.md index 2cee3ece799..89d6deca87d 100644 --- a/charts/stable/flaresolverr/README.md +++ b/charts/stable/flaresolverr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/flaresolverr/security.md b/charts/stable/flaresolverr/security.md index 8e810c16560..7de86c46a12 100644 --- a/charts/stable/flaresolverr/security.md +++ b/charts/stable/flaresolverr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/fleet/CHANGELOG.md b/charts/stable/fleet/CHANGELOG.md index 443520c74dc..a4cd2529076 100644 --- a/charts/stable/fleet/CHANGELOG.md +++ b/charts/stable/fleet/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fleet-0.0.7](https://github.com/truecharts/apps/compare/fleet-0.0.6...fleet-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fleet-0.0.6](https://github.com/truecharts/apps/compare/fleet-0.0.5...fleet-0.0.6) (2021-12-19) diff --git a/charts/stable/fleet/README.md b/charts/stable/fleet/README.md index 1d35ec31bdd..a77be5e62e9 100644 --- a/charts/stable/fleet/README.md +++ b/charts/stable/fleet/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/fleet/security.md b/charts/stable/fleet/security.md index 21949290979..1fd81fc4e36 100644 --- a/charts/stable/fleet/security.md +++ b/charts/stable/fleet/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/fleet:v2.3.2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -290,8 +283,8 @@ hide: | com.fasterxml.jackson.core:jackson-databind | CVE-2019-12384 | MEDIUM | 2.9.6 | 2.7.9.6, 2.8.11.4, 2.9.9.1 |
Expand...https://access.redhat.com/errata/RHSA-2019:1820
https://access.redhat.com/errata/RHSA-2019:2720
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:2935
https://access.redhat.com/errata/RHSA-2019:2936
https://access.redhat.com/errata/RHSA-2019:2937
https://access.redhat.com/errata/RHSA-2019:2938
https://access.redhat.com/errata/RHSA-2019:2998
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3200
https://access.redhat.com/errata/RHSA-2019:3292
https://access.redhat.com/errata/RHSA-2019:3297
https://access.redhat.com/errata/RHSA-2019:3901
https://access.redhat.com/errata/RHSA-2019:4352
https://blog.doyensec.com/2019/07/22/jackson-gadgets.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12384
https://doyensec.com/research.html
https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234
https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad
https://github.com/FasterXML/jackson-databind/issues/2334
https://github.com/advisories/GHSA-mph4-vhrx-mv67
https://linux.oracle.com/cve/CVE-2019-12384.html
https://linux.oracle.com/errata/ELSA-2019-2720.html
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/
https://nvd.nist.gov/vuln/detail/CVE-2019-12384
https://seclists.org/bugtraq/2019/Oct/6
https://security.netapp.com/advisory/ntap-20190703-0002/
https://www.debian.org/security/2019/dsa-4542
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | com.fasterxml.jackson.core:jackson-databind | CVE-2019-12814 | MEDIUM | 2.9.6 | 2.7.9.6, 2.8.11.4, 2.9.9.1 |
Expand...https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:2935
https://access.redhat.com/errata/RHSA-2019:2936
https://access.redhat.com/errata/RHSA-2019:2937
https://access.redhat.com/errata/RHSA-2019:2938
https://access.redhat.com/errata/RHSA-2019:3044
https://access.redhat.com/errata/RHSA-2019:3045
https://access.redhat.com/errata/RHSA-2019:3046
https://access.redhat.com/errata/RHSA-2019:3050
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3200
https://access.redhat.com/errata/RHSA-2019:3292
https://access.redhat.com/errata/RHSA-2019:3297
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12814
https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
https://github.com/FasterXML/jackson-databind/issues/2341
https://github.com/advisories/GHSA-cmfg-87vq-g5g4
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E
https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd@%3Ccommits.accumulo.apache.org%3E
https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/
https://nvd.nist.gov/vuln/detail/CVE-2019-12814
https://security.netapp.com/advisory/ntap-20190625-0006/
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.7 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.eclipse.jetty:jetty-client | CVE-2020-27216 | HIGH | 9.4.20.v20190813 | 9.3.29.v20201019, 9.4.32.v20200930, 11.0.1 |
Expand...https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921
https://cwe.mitre.org/data/definitions/378.html
https://cwe.mitre.org/data/definitions/379.html
https://github.com/advisories/GHSA-g3wg-6mcf-8jj6
https://github.com/eclipse/jetty.project/issues/5451
https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6
https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053
https://github.com/github/codeql/pull/4473
https://lists.apache.org/thread.html/r0259b14ae69b87821e27fed1f5333ea86018294fd31aab16b1fac84e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r07525dc424ed69b3919618599e762f9ac03791490ca9d724f2241442@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r09b345099b4f88d2bed7f195a96145849243fb4e53661aa3bcf4c176@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d7ad4f02c44d5d53a9ffcbca7ff4a8138241322da9c5c35b5429630@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r0d95e01f52667f44835c40f6dea72bb4397f33cd70a564ea74f3836d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r0df8fe10fc36028cf6d0381ab66510917d0d68bc5ef7042001d03830@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0e9efe032cc65433251ee6470c66c334d4e7db9101e24cf91a3961f2@%3Ccommits.directory.apache.org%3E
https://lists.apache.org/thread.html/r0f5e9b93133ef3aaf31484bc3e15cc4b85f8af0fe4de2dacd9379d72@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r100c5c7586a23a19fdb54d8a32e17cd0944bdaa46277b35c397056f6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r171846414347ec5fed38241a9f8a009bd2c89d902154c6102b1fb39a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r185d10aae8161c08726f3ba9a1f1c47dfb97624ea6212fa217173204@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r18b6f10d9939419bae9c225d5058c97533cb376c9d6d0a0733ddd48d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r19e8b338af511641d211ff45c43646fe1ae19dc9897d69939c09cabe@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1d40368a309f9d835dcdd900249966e4fcbdf98c1cc4c84db2cd9964@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1d45051310b11c6d6476f20d71b08ea97cb76846cbf61d196bac1c3f@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1dbb87c9255ecefadd8de514fa1d35c1d493c0527d7672cf40505d04@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1ed79516bd6d248ea9f0e704dbfd7de740d5a75b71c7be8699fec824@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1ef28b89ff0281c87ba3a7659058789bf28a99b8074191f1c3678db8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1fe31643fc34b4a33ae3d416d92c271aa97663f1782767d25e1d9ff8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2122537d3f9beb0ce59f44371a951b226406719919656ed000984bd0@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r279254a1bd6434c943da52000476f307e62b6910755387aeca1ec9a1@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2aa316d008dab9ae48350b330d15dc1b863ea2a933558fbfc42b91a6@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2d17b2a4803096ba427f3575599ea29b55f5cf9dbc1f12ba044cae1a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2e02700f7cfecb213de50be83e066086bea90278cd753db7fdc2ccff@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2f732ee49d00610683ab5ddb4692ab25136b00bfd132ca3a590218a9@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3042a9dd2973aa229e52d022df7813e4d74b67df73bfa6d97bb0caf8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r336b1694a01858111e4625fb9ab2b07ad43a64a525cf6402e06aa6bf@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r351298dd39fc1ab63303be94b0c0d08acd72b17448e0346d7386189b@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E
https://lists.apache.org/thread.html/r382870d6ccfd60533eb0d980688261723ed8a0704dafa691c4e9aa68@%3Ccommits.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r3a763de620be72b6d74f46ec4bf39c9f35f8a0b39993212c0ac778ec@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3b0ce1549a1ccdd7e51ec66daf8d54d46f1571edbda88ed09c96d7da@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3e05ab0922876e74fea975d70af82b98580f4c14ba643c4f8a9e3a94@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3f32cb4965239399c22497a0aabb015b28b2372d4897185a6ef0ccd7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r407c316f6113dfc76f7bb3cb1693f08274c521064a92e5214197548e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4179c71908778cc0598ee8ee1eaed9b88fc5483c65373f45e087f650@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r44115ebfbf3b7d294d7a75f2d30bcc822dab186ebbcc2dce11915ca9@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4946ffd86ad6eb7cb7863311235c914cb41232380de8d9dcdb3c115c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4f29fb24639ebc5d15fc477656ebc2b3aa00fcfbe197000009c26b40@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r503045a75f4419d083cb63ac89e765d6fb8b10c7dacc0c54fce07cff@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r547bb14c88c5da2588d853ed3030be0109efa537dd797877dff14afd@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5494fdaf4a0a42a15c49841ba7ae577d466d09239ee1050458da0f29@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r556787f1ab14da034d79dfff0c123c05877bbe89ef163fd359b4564c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r568d354961fa88f206dc345411fb11d245c6dc1a8da3e80187fc6706@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r58f5b14dc5ae43583db3a7e872419aca97ebe47bcd7f7334f4128016@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r59e0878013d329dcc481eeafebdb0ee445b1e2852d0c4827b1ddaff2@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5a07f274f355c914054c7357ad6d3456ffaca064f26cd780acb90a9a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5a9462096c71593e771602beb0e69357adb5175d9a5c18d5181e0ab4@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6236ae4adc401e3b2f2575c22865f2f6c6ea9ff1d7b264b40d9602af@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r66e99d973fd79ddbcb3fbdb24f4767fe9b911f5b0abb05d7b6f65801@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r6b83ca85c8f9a6794b1f85bc70d1385ed7bc1ad07750d0977537154a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6dfa64ecc3d67c1a71c08bfa04064549179d499f8e20a8285c57bd51@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6f51a654ac2e67e3d1c65a8957cbbb127c3f15b64b4fcd626df03633@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r70f8bcccd304bd66c1aca657dbfc2bf11f73add9032571b01f1f733d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r71da5f51ef04cb95abae560425dce9667740cbd567920f516f76efb7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r73b5a9b677b707bbb7c1469ea746312c47838b312603bada9e382bba@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r761a52f1e214efec286ee80045d0012e955eebaa72395ad62cccbcfc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r769411eb43dd9ef77665700deb7fc491fc3ceb532914260c90b56f2f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r77dd041d8025a869156481d2268c67ad17121f64e31f9b4a1a220145@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r7bdc83513c12db1827b79b8d57a7a0975a25d28bc6c5efe590ec1e02@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r7da5ae60d7973e8894cfe92f49ecb5b47417eefab4c77cc87514d3cf@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r8045eedd6bb74efcd8e01130796adbab98ee4a0d1273509fb1f2077a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r819857361f5a156e90d6d06ccf6c41026bc99030d60d0804be3a9957@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r827d17bf6900eddc686f4b6ee16fc5e52ca0070f8df7612222c40ac5@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r874688141495df766e62be095f1dfb0bf4a24ca0340d8e0215c03fab@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r87b0c69fef09277333a7e1716926d1f237d462e143a335854ddd922f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r87d8337300a635d66f0bb838bf635cdfcbba6b92c608a7813adbf4f4@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8866f0cd2a3b319288b7eea20ac137b9f260c813d10ee2db88b65d32@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8cacf91ae1b17cc6531d20953c52fa52f6fd3191deb3383446086ab7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8dd01541fc49d24ec223365a9974231cbd7378b749247a89b0a52210@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8fead0144bb84d8714695c43607dca9c5101aa028a431ec695882fe5@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r90b5ac6e2bf190a5297bda58c7ec76d01cd86ff050b2470fcd9f4b35@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r911c1879258ebf98bca172c0673350eb7ea6569ca1735888d4cb7adc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r916b6542bd5b15a8a7ff8fc14a0e0331e8e3e9d682f22768ae71d775@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r93b240be16e642579ed794325bae31b040e1af896ecc12466642e19d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r93d5e81e879120d8d87925dbdd4045cb3afa9b066f4370f60b626ce3@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r9b790fe3a93121199f41258474222f15002b2f729495aa7ecbf90718@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9c010b79140452294292379183e7fe8e3533c5bb4db3f3fb39a6df61@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9cc76b98f87738791b8ec3736755f92444d3c8cb26bd4e4ffdb5c1cc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9cd444f944241dc26d9b8b007fe8971ed7f005b56befef7a4f4fb827@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9d9b4b93df7f92cdf1147db0fc169be1776c93d1fbc63bc65721fffd@%3Cdev.knox.apache.org%3E
https://lists.apache.org/thread.html/r9f8c45a2a4540911cd8bd0485f67e8091883c9234d7a3aeb349c46c1@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/ra1f19625cc67ac1b459c558f2ea5647d71ce51c6fe4f4cb03baec849@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra55e04d5a73afcb8383f4386e2b26832c6e3972e53827021ab885943@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/ra5b7313d8cc9411db6790adfba33f2cf0665cb77adb7b02043c95867@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/raa9c370ab42d737e93bc1795bb6a2187d7c60210cd5e3b3ce8f3c484@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rad255c736fad46135f1339408cb0147d0671e45c376c3be85ceeec1a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rae15d73cabef55bad148e4e6449b05da95646a2a8db3fc938e858dff@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/raf9c581b793c30ff8f55f2415c7bd337eb69775aae607bf9ed1b16fb@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rafb023a7c61180a1027819678eb2068b0b60cd5c2559cb8490e26c81@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb077d35f2940191daeefca0d6449cddb2e9d06bcf8f5af4da2df3ca2@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb5f2558ea2ac63633dfb04db1e8a6ea6bb1a2b8614899095e16c6233@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb69b1d7008a4b3de5ce5867e41a455693907026bc70ead06867aa323@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb7e159636b26156f6ef2b2a1a79b3ec9a026923b5456713e68f7c18e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb81a018f83fe02c95a2138a7bb4f1e1677bd7e1fc1e7024280c2292d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb8ad3745cb94c60d44cc369aff436eaf03dbc93112cefc86a2ed53ba@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb8c007f87dc57731a7b9a3b05364530422535b7e0bc6a0c5b68d4d55@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/rbc5a622401924fadab61e07393235838918228b3d8a1a6704295b032@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rbc5a8d7a0a13bc8152d427a7e9097cdeb139c6cfe111b2f00f26d16b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbf99e4495461099cad9aa62e0164f8f25a7f97b791b4ace56e375f8d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1646894341450fdc4f7e96a88f5e2cf18d8004714f98aec6b831b3e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1d9b8e9d17749d4d2b9abaaa72c422d090315bd6bc0ae73a16abc1c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc2e24756d28580eeac811c5c6a12012c9f424b6e5bffb89f98ee3d03@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/rc44d1147f78496ec9932a38b28795ff4fd0c4fa6e3b6f5cc33c14d29@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc4b972ea10c5a65c6a88a6e233778718ab9af7f484affdd5e5de0cff@%3Ccommits.felix.apache.org%3E
https://lists.apache.org/thread.html/rc77918636d8744d50312e4f67ba2e01f47db3ec5144540df8745cb38@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc8dd95802be0cca8d7d0929c0c8484ede384ecb966b2a9dc7197b089@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rc9d2ab8a6c7835182f20b01104798e67c75db655c869733a0713a590@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rccedec4cfd5df6761255b71349e3b7c27ee0745bd33698a71b1775cf@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcdcf32952397c83a1d617a8c9cd5c15c98b8d0d38a607972956bde7e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcdd56ab4255801a0964dcce3285e87f2c6994e6469e189f6836f34e3@%3Cnotifications.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rcfb95a7c69c4b9c082ea1918e812dfc45aa0d1e120fd47f68251a336@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcff5caebfd535195276aaabc1b631fd55a4ff6b14e2bdfe33f18ff91@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd58b60ab2e49ebf21022e59e280feb25899ff785c88f31fe314aa5b9@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rd7e62e2972a41c2658f41a824b8bdd15644d80fcadc51fe7b7c855de@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rdbf1cd0ab330c032f3a09b453cb6405dccc905ad53765323bddab957@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rdddb4b06e86fd58a1beda132f22192af2f9b56aae8849cb3767ccd55@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rde11c433675143d8d27551c3d9e821fe1955f1551a518033d3716553@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rde782fd8e133f7e04e50c8aaa4774df524367764eb5b85bf60d96747@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re08b03cd1754b32f342664eead415af48092c630c8e3e0deba862a26@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/re5706141ca397587f7ee0f500a39ccc590a41f802fc125fc135cb92f@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ree506849c4f04376793b1a3076bc017da60b8a2ef2702dc214ff826f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/refbbb0eb65c185d1fa491cee08ac8ed32708ce3b269133a6da264317@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rf00ea6376f3d0e8b8f62cf6d4a4f28b24e27193acd2c851f618aa41e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rf3bc023a7cc729aeac72f482e2eeeab9008aa6b1dadbeb3f45320cae@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfd9f102864a039f7fda64a580dfe1a342d65d7b723ca06dc9fbceb31@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfe5caef1fd6cf4b8ceac1b63c33195f2908517b665c946c020d3fbd6@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfe6ba83d14545e982400dea89e68b10113cb5202a3dcb558ce64842d@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rff0ad6a7dac2182421e2db2407e44fbb61a89904adfd91538f21fbf8@%3Cissues.beam.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2020-27216
https://security.netapp.com/advisory/ntap-20201123-0005/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.eclipse.jetty:jetty-client | CVE-2021-28165 | HIGH | 9.4.20.v20190813 | 9.4.39.v20210325, 10.0.2, 11.0.2 |
Expand...http://www.openwall.com/lists/oss-security/2021/04/20/3
https://github.com/advisories/GHSA-26vr-8j45-3r4w
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711cbf334e2913332730a@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a8b928916ef65dd2ad@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47da164002bf2baffe5@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002da0ddac5ad851ae7e7@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e66970eafd54f9c3e2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c1fab8203ebd212add@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391cf94ec4e1f4537ae3@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35bec149c0cc247579c42@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5cb2e7fd0c9a78f97c4@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced7641b92a22a783287@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865ea1e891572d15faa6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d668a9497c999946cd78@%3Ccommits.spark.apache.org%3E
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd8be6ac4d6aea4f0cf@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee2361bf01549f9e3440ca@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a4d55b3b4b8891becb@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f525c232ec5b8eb83a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b72af9f9410cffbe35@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880ddf28a796f09ce152@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b6e6d2c2a423f8baee@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db4805ea4a998d4c225@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae915100099c4391ad64e9ae38b@%3Cdev.hbase.apache.org%3E
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf669d6f7da59ef1eb155@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c1b1ada3920b01e959@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91acc646607cbc0a4da@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3dd4f2a024c1e43b94@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad0642db8c936e4f0b7@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135a1a2f45786417adb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c469175410777a78d812@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340c798dfcb55cb7acc7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5e15023de29ebd4f9f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d5994d08507a2e5477c9@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb353604dd2f765c9da5df7@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f28543252e887ca03bd5621e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda3987084595192e3845d@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587fd5939fe8be09907c7@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c139021f40a5774090@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c71ecc720b8ecf281f0@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d95669b3afbf6efa36@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e3131322be9c07a1da@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d631cf54899082058ef1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f07294959d60fea1bd76f7d81@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1de49dc7fd04cad1ebc@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc593394d144755824da@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350e8589269a72fd7913@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c7755029e944dfee31b8b779@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb4bebb2416da638424@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76f232277446ae0948a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31375bc42a0dcc964b2@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7fe561bb7e036e8449@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf8e3fb37fcf33b2cd0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd116d2170a3eed9f5c@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c2536b00c56738beef@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea3776b911e024fa3b187@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04a2edcd23761894464@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1edccd56fa9fb7a547f2@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d586ae1f9f505a311c@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2aeefb7f96fe348537b@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d5054cc34561cb89b81af@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc457975fc0445ac97f@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e2e64992137f4dc63d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aac1a47551f0dc55486@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55d025666fe41099f33@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c24477e7b1ac9be076a825@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11af66e7ec72128d020@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036cb67987ad42c1f2dce@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970dc1bc5cd214b711f77@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf629425418c2b69bb16745f@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa8a85b10a73403ee97@%3Ccommits.spark.apache.org%3E
https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f201b77e1afcf774e7a6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd136739089c3231658e398cf38@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e@%3Cdev.ignite.apache.org%3E
https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b2d57a2bdb0341536e@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a6172117d62b8e57596aa@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044ccb37a30768938f7e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f15a8c4212fad89d9f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da624250c559999eaeb@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68ef5f6839ffca9c1c1@%3Ccommits.hbase.apache.org%3E
https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c19958196354b39568c532f26@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea9931c9b19709b87f292b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df68bf9334736107a6e@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c1a3d89933173deed6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed7d506be9357a3a7ec@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719d2f83a41e8faf295f@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31b800bf37f01473ad7@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a6999560212e519b5f09db0aed@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b2e142e3e1c6774743@%3Creviews.spark.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-28165
https://security.netapp.com/advisory/ntap-20210611-0006/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.eclipse.jetty:jetty-client | CVE-2020-27223 | MEDIUM | 9.4.20.v20190813 | 9.4.36.v20210114, 10.0.1, 11.0.1 |
Expand...https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128
https://github.com/advisories/GHSA-m394-8rww-3jr7
https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7
https://lists.apache.org/thread.html/r068dfd35ce2193f6af28b74ff29ab148c2b2cacb235995576f5bea78@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r07aedcb1ece62969c406cb84c8f0e22cec7e42cdc272f3176e473320@%3Cusers.solr.apache.org%3E
https://lists.apache.org/thread.html/r0b639bd9bfaea265022125d18acd2fc6456044b76609ec74772c9567@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0c6eced465950743f3041b03767a32b2e98d19731bd72277fc7ea428@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0cdab13815fc419805a332278c8d27e354e78560944fc36db0bdc760@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0e25cdf3722a24c53049d37396f0da8502cb4b7cdc481650dc601dbc@%3Cgitbox.activemq.apache.org%3E
https://lists.apache.org/thread.html/r105f4e52feb051faeb9141ef78f909aaf5129d6ed1fc52e099c79463@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r1414ab2b3f4bb4c0e736caff6dc8d15f93f6264f0cca5c47710d7bb3@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r1b7ed296a865e3f1337a96ee9cd51f6d154d881a30da36020ca72a4b@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r1b803e6ebdac5f670708878fb1b27cd7a0ce9d774a60e797e58cee6f@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r26d9196f4d2afb9bec2784bcb6fc183aca82e4119bf41bdc613eec01@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r27ad7843d060762cc942820566eeaa9639f75371afedf8124b943283@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r2c2c7b2971360fb946bbf062c58d7245927dd1ce9150fc9987f65409@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2c947376491a20d1cf143bf3c21ed74113e099d806cfe4c490a45ad8@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r35ab810c0f3016b3fd3a3fa9088a2d2781b354a810780ce74d022b6c@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3ce0e31b25ad4ee8f7c42b62cfdc72d1b586f5d6accd23f5295b6dd1@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r409ee2bae66bfff6aa89e6c74aff535e6248260d3afcb42bfb3b316b@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r463b12b27264c5e1e3c48c8c2cc5d33813d2f0d981102548fb3102fb@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r492cff8488a7f6eb96700afb5d137b719ddb80a833e77f971d2691c6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4a456d89a83752a012d88a60ff4b21def6c9f650b9e69ea9fa11c9f9@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r4c92ea39167c0f7b096ae8268db496b5451d69606f0304b7c8a994c7@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r51f8975ef47c12a46fbfd7da9efea7f08e1d307fe1dc3042514659ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r521a077885ce79c44a799118c878589e81e525cab72d368e5cfb6f61@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r5612dc69e1f79c421faf9764ffbc92591e2a69ea417c04cba57f49ea@%3Cuser.karaf.apache.org%3E
https://lists.apache.org/thread.html/r562a0cbc5c8cac4d000a27b2854a8ab1b924aa9dd45f8ffbea98e5ad@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r5b7cc6ac733e0b35816751cf45d152ae246a3f40e0b1e62b101c9522@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r601f15f3de7ae3a7bbcd780c19155075c56443c2cdc1d193c03b4182@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r65c714241b9d064a44fec10d60ebf5a37d5ebadd6bf88b0eed13ade0@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r734f996149bb9b1796740385fcbdf3e093eb9aabedc0f20a48ea1d68@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r75ee2a529edb892ac59110cb3f6f91844a932c5034e16c8317f5668d@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7f4ad5eec0bce2821c308bb23cac53df5c94eb84de1c58de9b95c176@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7fbdb7880be1566f943d80fbbeefde2115c086eba1bef3115350a388@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7ffd050d3bd7c90d95f4933560b5f4f15971ab9a5f5322fdce116243@%3Cdev.lucene.apache.org%3E
https://lists.apache.org/thread.html/r855b24a3bde3674256152edfc53fb8c9000f9b59db3fecbbde33b211@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r857b31ad16c6e76002bc6cca73c83358ed2595477e288286ee82c48d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r897a6a14d03eab09e89b809d2a650f3765065201da5bc3db9a4dd6e8@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8b1963f16d6cb1230ca7ee73b6ec4f5c48f344191dbb1caabd265ee4@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8dc1b13b80d39fbf4a9d158850e15cd868f0460c2f364f13dca7050b@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra2f529da674f25a7351543544f7d621b5227c49a0745913b1194d11e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/ra384892bab8c03a60613a6a9d5e9cae0a2b800fd882792a55520115e@%3Ccommits.kafka.apache.org%3E
https://lists.apache.org/thread.html/ra40a88a2301a3da86e25b501ff4bc88124f2b816c2917d5f3497f8f0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra47a26c008487b0a739a368c846e168de06c3cd118d31ecedafa679a@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/raa6d60b00b67c0550672b4f506f0df75b323dcd25cf574e91e2f2dff@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb79b62ac3085e05656e41865f5a7efcbdc7dcd7843abed9c5fe0fef8@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc052fd4e9e9c01bead74c0b5680355ea5dc3b72d46f253cb65d03e43@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rc721fe2910533bffb6bd4d69ea8ff4f36066d260dbcd2d14e041614a@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/rd666e187ebea2fda8624683ab51e2a5ad2108f762d21bf1a383d7502@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rd8e24a3e482e5984bc8c5492dc790413e4fdc1234e3debb94515796b@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdd6c47321db1bfe12c68a898765bf3b6f97e2afa6a501254ed4feaed@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/re03a4dbc15df6f390a2f8c0a071c31c8324dbef007e59fdc2592091a@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re0d38cc2b5da28f708fc89de49036f3ace052c47a1202f7d70291614@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/re19fa47ec901cc3cf6d7784027198e8113f8bc2dbfd6c9d6d13f5447@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re3bd4f831f9be49871cb6adb997289b5dbcd6fe4bc5cb08223254080@%3Cdev.lucene.apache.org%3E
https://lists.apache.org/thread.html/re43768896273c0b5f1a03d7f0a9d370852074489d51825fdc0d77f0f@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re819198d4732804dc01fca8b5b144689a118ede49f6128968773595c@%3Ccommits.kafka.apache.org%3E
https://lists.apache.org/thread.html/reb3c6dc050c7ee18ea154cd94dba85d99aa6b02b84c4bb2138a4abf2@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/reca91f217f9e1ce607ce6e19a1c0b3db82b5b1b58cf39a84d6434695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf190d1d28e1367d1664ef6bc2f71227566d7b6b39209817a5364da1f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rf6c2efa3137bc8c22707e550a1f9b80f74bca62b9c8a6f768f2c6b86@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf77f4c4583669f1133d58cc4f1964367e253818ed8db986bb2732f7c@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rff630ce92a4d1bb494fc1a3f9b57a3d60819b436505bcd8c6ccc713c@%3Ccommits.kafka.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-27223
https://security.netapp.com/advisory/ntap-20210401-0005/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com/security-alerts/cpuApr2021.html
| @@ -343,7 +336,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/flood/CHANGELOG.md b/charts/stable/flood/CHANGELOG.md index d4254720da4..7887ce40c0e 100644 --- a/charts/stable/flood/CHANGELOG.md +++ b/charts/stable/flood/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [flood-4.0.26](https://github.com/truecharts/apps/compare/flood-4.0.25...flood-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [flood-4.0.25](https://github.com/truecharts/apps/compare/flood-4.0.24...flood-4.0.25) (2021-12-19) diff --git a/charts/stable/flood/README.md b/charts/stable/flood/README.md index e11dc36ba0c..5b96bce45a5 100644 --- a/charts/stable/flood/README.md +++ b/charts/stable/flood/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/flood/security.md b/charts/stable/flood/security.md index e209ab09f69..f94ea18dbb6 100644 --- a/charts/stable/flood/security.md +++ b/charts/stable/flood/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-flood' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/focalboard/CHANGELOG.md b/charts/stable/focalboard/CHANGELOG.md index 2b8fb07f750..714c72262a3 100644 --- a/charts/stable/focalboard/CHANGELOG.md +++ b/charts/stable/focalboard/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [focalboard-4.0.27](https://github.com/truecharts/apps/compare/focalboard-4.0.26...focalboard-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [focalboard-4.0.26](https://github.com/truecharts/apps/compare/focalboard-4.0.25...focalboard-4.0.26) (2021-12-19) diff --git a/charts/stable/focalboard/README.md b/charts/stable/focalboard/README.md index a29663faee5..010bc647ea5 100644 --- a/charts/stable/focalboard/README.md +++ b/charts/stable/focalboard/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/focalboard/security.md b/charts/stable/focalboard/security.md index ce2cfd5c6f9..f8027ccfa23 100644 --- a/charts/stable/focalboard/security.md +++ b/charts/stable/focalboard/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-focalboard' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -125,3 +122,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/tidwall/gjson | CVE-2021-42836 | HIGH | v1.7.3 | v1.9.3 |
Expand...https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
https://github.com/tidwall/gjson/issues/236
https://github.com/tidwall/gjson/issues/237
https://nvd.nist.gov/vuln/detail/CVE-2021-42836
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5 | 0.3.7 |
Expand...
| diff --git a/charts/stable/foldingathome/CHANGELOG.md b/charts/stable/foldingathome/CHANGELOG.md index 6ad5ca85e55..52ae620d4ec 100644 --- a/charts/stable/foldingathome/CHANGELOG.md +++ b/charts/stable/foldingathome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [foldingathome-0.0.8](https://github.com/truecharts/apps/compare/foldingathome-0.0.7...foldingathome-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [foldingathome-0.0.7](https://github.com/truecharts/apps/compare/foldingathome-0.0.6...foldingathome-0.0.7) (2021-12-19) diff --git a/charts/stable/foldingathome/README.md b/charts/stable/foldingathome/README.md index 791b6031f45..4ffe6746599 100644 --- a/charts/stable/foldingathome/README.md +++ b/charts/stable/foldingathome/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/foldingathome/security.md b/charts/stable/foldingathome/security.md index 03727c52fe4..e2dac63d708 100644 --- a/charts/stable/foldingathome/security.md +++ b/charts/stable/foldingathome/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/fossil/CHANGELOG.md b/charts/stable/fossil/CHANGELOG.md index 4399cf66e0c..b061a5f5b64 100644 --- a/charts/stable/fossil/CHANGELOG.md +++ b/charts/stable/fossil/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fossil-2.0.26](https://github.com/truecharts/apps/compare/fossil-2.0.25...fossil-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fossil-2.0.25](https://github.com/truecharts/apps/compare/fossil-2.0.24...fossil-2.0.25) (2021-12-19) diff --git a/charts/stable/fossil/README.md b/charts/stable/fossil/README.md index 4c345e1854d..477d083e4b5 100644 --- a/charts/stable/fossil/README.md +++ b/charts/stable/fossil/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/fossil/security.md b/charts/stable/fossil/security.md index 7476cab8d6e..c6d8ec9a89c 100644 --- a/charts/stable/fossil/security.md +++ b/charts/stable/fossil/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/freeradius/CHANGELOG.md b/charts/stable/freeradius/CHANGELOG.md index ccd844018c7..ed4e03a5218 100644 --- a/charts/stable/freeradius/CHANGELOG.md +++ b/charts/stable/freeradius/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [freeradius-4.0.29](https://github.com/truecharts/apps/compare/freeradius-4.0.28...freeradius-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [freeradius-4.0.28](https://github.com/truecharts/apps/compare/freeradius-4.0.27...freeradius-4.0.28) (2021-12-19) diff --git a/charts/stable/freeradius/README.md b/charts/stable/freeradius/README.md index f8f8ab0ee5d..ed02920c636 100644 --- a/charts/stable/freeradius/README.md +++ b/charts/stable/freeradius/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/freeradius/security.md b/charts/stable/freeradius/security.md index d551af36ed1..ff9f90c4f3a 100644 --- a/charts/stable/freeradius/security.md +++ b/charts/stable/freeradius/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/freshrss/CHANGELOG.md b/charts/stable/freshrss/CHANGELOG.md index 4cbacd90be5..e71f851ed3f 100644 --- a/charts/stable/freshrss/CHANGELOG.md +++ b/charts/stable/freshrss/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [freshrss-9.0.30](https://github.com/truecharts/apps/compare/freshrss-9.0.29...freshrss-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [freshrss-9.0.29](https://github.com/truecharts/apps/compare/freshrss-9.0.28...freshrss-9.0.29) (2021-12-19) diff --git a/charts/stable/freshrss/README.md b/charts/stable/freshrss/README.md index dd296f088d1..16c459c837d 100644 --- a/charts/stable/freshrss/README.md +++ b/charts/stable/freshrss/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/freshrss/security.md b/charts/stable/freshrss/security.md index 88e8198144a..5e41d01ec01 100644 --- a/charts/stable/freshrss/security.md +++ b/charts/stable/freshrss/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/friendica/CHANGELOG.md b/charts/stable/friendica/CHANGELOG.md index ef7224ec805..5ff225e3849 100644 --- a/charts/stable/friendica/CHANGELOG.md +++ b/charts/stable/friendica/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [friendica-0.0.18](https://github.com/truecharts/apps/compare/friendica-0.0.17...friendica-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [friendica-0.0.17](https://github.com/truecharts/apps/compare/friendica-0.0.16...friendica-0.0.17) (2021-12-19) diff --git a/charts/stable/friendica/README.md b/charts/stable/friendica/README.md index 52500d091d5..a39048b0ddc 100644 --- a/charts/stable/friendica/README.md +++ b/charts/stable/friendica/README.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/friendica/security.md b/charts/stable/friendica/security.md index efe0f20b2ae..6a6815a159f 100644 --- a/charts/stable/friendica/security.md +++ b/charts/stable/friendica/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,11 +46,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -72,9 +60,9 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/friendica:v2021.09@sha256:5af8766837016690d589a928e800ebd67718a348822e3ecb31e24b45bb6cf8a0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -121,6 +109,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -131,6 +121,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -141,6 +133,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -151,6 +145,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -860,7 +856,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -879,7 +875,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -889,13 +885,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -942,7 +940,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -1076,7 +1078,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** @@ -1278,7 +1280,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/gaps/CHANGELOG.md b/charts/stable/gaps/CHANGELOG.md index 0286c86c05a..fe889deaaa5 100644 --- a/charts/stable/gaps/CHANGELOG.md +++ b/charts/stable/gaps/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gaps-9.0.27](https://github.com/truecharts/apps/compare/gaps-9.0.26...gaps-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gaps-9.0.26](https://github.com/truecharts/apps/compare/gaps-9.0.25...gaps-9.0.26) (2021-12-19) diff --git a/charts/stable/gaps/README.md b/charts/stable/gaps/README.md index 09b01d71df4..0d9258e2c39 100644 --- a/charts/stable/gaps/README.md +++ b/charts/stable/gaps/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/gaps/security.md b/charts/stable/gaps/security.md index a45a1404b5a..eac61dfef23 100644 --- a/charts/stable/gaps/security.md +++ b/charts/stable/gaps/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gaps' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -214,8 +211,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | ch.qos.logback:logback-core | CVE-2021-42550 | MEDIUM | 1.2.3 | |
Expand...http://logback.qos.ch/news.html
https://github.com/advisories/GHSA-668q-qrv7-99fm
https://github.com/cn-panda/logbackRceDemo
https://github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.html
https://github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359c
https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42
https://jira.qos.ch/browse/LOGBACK-1591
https://nvd.nist.gov/vuln/detail/CVE-2021-42550
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.13.3 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.3 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.13.3 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.13.3 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.3 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 9.0.39 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 9.0.39 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25329 | HIGH | 9.0.39 | 7.0.108, 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/2
https://github.com/advisories/GHSA-jgwr-3qm3-26f3
https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25329
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/charts/stable/gitea/CHANGELOG.md b/charts/stable/gitea/CHANGELOG.md index ad8c9d63af9..faaa6a2fbf8 100644 --- a/charts/stable/gitea/CHANGELOG.md +++ b/charts/stable/gitea/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gitea-5.0.20](https://github.com/truecharts/apps/compare/gitea-5.0.19...gitea-5.0.20) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gitea-5.0.19](https://github.com/truecharts/apps/compare/gitea-5.0.18...gitea-5.0.19) (2021-12-19) diff --git a/charts/stable/gitea/README.md b/charts/stable/gitea/README.md index 06f4af19cda..26aaf440893 100644 --- a/charts/stable/gitea/README.md +++ b/charts/stable/gitea/README.md @@ -19,9 +19,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | memcached | 1.0.36 | -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | memcached | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/gitea/security.md b/charts/stable/gitea/security.md index 707bc669428..b8b547ba87e 100644 --- a/charts/stable/gitea/security.md +++ b/charts/stable/gitea/security.md @@ -19,27 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-memcached' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | Type | Misconfiguration ID | Check | Severity | Explaination | Links | |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -61,11 +54,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -76,11 +64,6 @@ hide: | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -91,20 +74,21 @@ hide: | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gitea' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7' 'tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7' tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/memcached:v1.6.12@sha256:4bb7e6c427149148fbcd496366700aa348e6a1078f83534de2f897b8790a357a + tccr.io/truecharts/memcached:v1.6.12@sha256:1125ac2a97ea10c4768b349c396aa8e5e12755771d2db76ff94384e390154391 ##### Scan Results @@ -141,7 +125,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -383,10 +367,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -421,7 +404,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -669,7 +652,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/memcached:v1.6.12@sha256:4bb7e6c427149148fbcd496366700aa348e6a1078f83534de2f897b8790a357a (debian 10.11) +#### Container: tccr.io/truecharts/memcached:v1.6.12@sha256:1125ac2a97ea10c4768b349c396aa8e5e12755771d2db76ff94384e390154391 (debian 10.11) **debian** diff --git a/charts/stable/golinks/CHANGELOG.md b/charts/stable/golinks/CHANGELOG.md index f26e23d70c8..5c2d0bb4a82 100644 --- a/charts/stable/golinks/CHANGELOG.md +++ b/charts/stable/golinks/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [golinks-2.0.26](https://github.com/truecharts/apps/compare/golinks-2.0.25...golinks-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [golinks-2.0.25](https://github.com/truecharts/apps/compare/golinks-2.0.24...golinks-2.0.25) (2021-12-19) diff --git a/charts/stable/golinks/README.md b/charts/stable/golinks/README.md index 79e3aa765ec..91a0801abf8 100644 --- a/charts/stable/golinks/README.md +++ b/charts/stable/golinks/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/golinks/security.md b/charts/stable/golinks/security.md index a4534130d1e..ffe98d62f80 100644 --- a/charts/stable/golinks/security.md +++ b/charts/stable/golinks/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/gonic/CHANGELOG.md b/charts/stable/gonic/CHANGELOG.md index fad114800ec..466b8e20764 100644 --- a/charts/stable/gonic/CHANGELOG.md +++ b/charts/stable/gonic/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gonic-4.0.26](https://github.com/truecharts/apps/compare/gonic-4.0.25...gonic-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gonic-4.0.25](https://github.com/truecharts/apps/compare/gonic-4.0.24...gonic-4.0.25) (2021-12-19) diff --git a/charts/stable/gonic/README.md b/charts/stable/gonic/README.md index 75664758b34..63408551ca7 100644 --- a/charts/stable/gonic/README.md +++ b/charts/stable/gonic/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/gonic/security.md b/charts/stable/gonic/security.md index 154d5046a1c..6f0112e0a4d 100644 --- a/charts/stable/gonic/security.md +++ b/charts/stable/gonic/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -136,5 +132,7 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| diff --git a/charts/stable/gotify/CHANGELOG.md b/charts/stable/gotify/CHANGELOG.md index f8586071f69..af5c380cdf1 100644 --- a/charts/stable/gotify/CHANGELOG.md +++ b/charts/stable/gotify/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gotify-5.0.18](https://github.com/truecharts/apps/compare/gotify-5.0.17...gotify-5.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gotify-5.0.17](https://github.com/truecharts/apps/compare/gotify-5.0.16...gotify-5.0.17) (2021-12-19) diff --git a/charts/stable/gotify/README.md b/charts/stable/gotify/README.md index 71ec0ba8b04..5036e9b11b0 100644 --- a/charts/stable/gotify/README.md +++ b/charts/stable/gotify/README.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/gotify/security.md b/charts/stable/gotify/security.md index efb8d89161e..ec9a8cd76ef 100644 --- a/charts/stable/gotify/security.md +++ b/charts/stable/gotify/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gotify' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/gotify-server:v2.1.3@sha256:832ee2e12000da56c5778813dd69b60694dcfcea853afac684f12402c89295f4 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -411,10 +402,11 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| github.com/go-yaml/yaml | CVE-2019-11254 | MEDIUM | v2.1.0+incompatible | |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| github.com/go-yaml/yaml | GO-2021-0061 | UNKNOWN | v2.1.0+incompatible | |
Expand...
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -449,7 +441,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/grafana/CHANGELOG.md b/charts/stable/grafana/CHANGELOG.md index ec90bc2c105..4d334ea8ec2 100644 --- a/charts/stable/grafana/CHANGELOG.md +++ b/charts/stable/grafana/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [grafana-2.0.11](https://github.com/truecharts/apps/compare/grafana-2.0.10...grafana-2.0.11) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [grafana-2.0.10](https://github.com/truecharts/apps/compare/grafana-2.0.9...grafana-2.0.10) (2021-12-20) diff --git a/charts/stable/grafana/README.md b/charts/stable/grafana/README.md index 17932dcd948..35398c3cd89 100644 --- a/charts/stable/grafana/README.md +++ b/charts/stable/grafana/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/grafana/helm-values.md b/charts/stable/grafana/helm-values.md index 77b08c47f4d..0e9a20cabdf 100644 --- a/charts/stable/grafana/helm-values.md +++ b/charts/stable/grafana/helm-values.md @@ -22,7 +22,7 @@ You will, however, be able to use all values referenced in the common chart here | env.GF_PATHS_PROVISIONING | string | `"/opt/bitnami/grafana/conf/provisioning"` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/grafana"` | | -| image.tag | string | `"v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63"` | | +| image.tag | string | `"v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d"` | | | metrics.enabled | bool | See values.yaml | Enable and configure a Prometheus serviceMonitor for the chart under this key. | | metrics.prometheusRule | object | See values.yaml | Enable and configure Prometheus Rules for the chart under this key. | | metrics.prometheusRule.rules | list | See prometheusrules.yaml | Configure additionial rules for the chart under this key. | diff --git a/charts/stable/grafana/security.md b/charts/stable/grafana/security.md index d89b48b749c..813783183bb 100644 --- a/charts/stable/grafana/security.md +++ b/charts/stable/grafana/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-grafana' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/grafana:v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63 + tccr.io/truecharts/grafana:v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/grafana:v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63 (debian 10.11) +#### Container: tccr.io/truecharts/grafana:v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d (debian 10.11) **debian** diff --git a/charts/stable/grav/CHANGELOG.md b/charts/stable/grav/CHANGELOG.md index 2ff2a4f2a59..c4b10720e3e 100644 --- a/charts/stable/grav/CHANGELOG.md +++ b/charts/stable/grav/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [grav-2.0.26](https://github.com/truecharts/apps/compare/grav-2.0.25...grav-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [grav-2.0.25](https://github.com/truecharts/apps/compare/grav-2.0.24...grav-2.0.25) (2021-12-19) diff --git a/charts/stable/grav/README.md b/charts/stable/grav/README.md index 246aa94c6a0..ffcc5baa536 100644 --- a/charts/stable/grav/README.md +++ b/charts/stable/grav/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/grav/security.md b/charts/stable/grav/security.md index 5a0bb449cbf..99d4fddb767 100644 --- a/charts/stable/grav/security.md +++ b/charts/stable/grav/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/grocy/CHANGELOG.md b/charts/stable/grocy/CHANGELOG.md index 37fcd2fb588..9495be6804b 100644 --- a/charts/stable/grocy/CHANGELOG.md +++ b/charts/stable/grocy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [grocy-9.0.27](https://github.com/truecharts/apps/compare/grocy-9.0.26...grocy-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [grocy-9.0.26](https://github.com/truecharts/apps/compare/grocy-9.0.25...grocy-9.0.26) (2021-12-19) diff --git a/charts/stable/grocy/README.md b/charts/stable/grocy/README.md index 8e01167710c..863a46a3ef4 100644 --- a/charts/stable/grocy/README.md +++ b/charts/stable/grocy/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/grocy/security.md b/charts/stable/grocy/security.md index fb2076b0fec..aa269121b6f 100644 --- a/charts/stable/grocy/security.md +++ b/charts/stable/grocy/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -101,4 +97,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| illuminate/view | CVE-2021-43808 | MEDIUM | v8.55.0 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| illuminate/view | CVE-2021-43808 | MEDIUM | v8.55.0 | 8.75.0, 6.20.42, 7.30.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| diff --git a/charts/stable/guacd/CHANGELOG.md b/charts/stable/guacd/CHANGELOG.md index 5f9e0805fb5..aa89e432472 100644 --- a/charts/stable/guacd/CHANGELOG.md +++ b/charts/stable/guacd/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [guacd-0.0.7](https://github.com/truecharts/apps/compare/guacd-0.0.6...guacd-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [guacd-0.0.6](https://github.com/truecharts/apps/compare/guacd-0.0.5...guacd-0.0.6) (2021-12-19) diff --git a/charts/stable/guacd/README.md b/charts/stable/guacd/README.md index 52c8b8b7d58..46820349d72 100644 --- a/charts/stable/guacd/README.md +++ b/charts/stable/guacd/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/guacd/security.md b/charts/stable/guacd/security.md index 0750f82937e..8a9c79a01fd 100644 --- a/charts/stable/guacd/security.md +++ b/charts/stable/guacd/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/habridge/CHANGELOG.md b/charts/stable/habridge/CHANGELOG.md index 727d0b4e1f3..894c8588038 100644 --- a/charts/stable/habridge/CHANGELOG.md +++ b/charts/stable/habridge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [habridge-0.0.8](https://github.com/truecharts/apps/compare/habridge-0.0.7...habridge-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [habridge-0.0.7](https://github.com/truecharts/apps/compare/habridge-0.0.6...habridge-0.0.7) (2021-12-19) diff --git a/charts/stable/habridge/README.md b/charts/stable/habridge/README.md index ce153efd742..e5eed52b82d 100644 --- a/charts/stable/habridge/README.md +++ b/charts/stable/habridge/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/habridge/security.md b/charts/stable/habridge/security.md index c72446f837b..27c62df3b6b 100644 --- a/charts/stable/habridge/security.md +++ b/charts/stable/habridge/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/handbrake/CHANGELOG.md b/charts/stable/handbrake/CHANGELOG.md index 23bfc9b069b..5d1b27d8352 100644 --- a/charts/stable/handbrake/CHANGELOG.md +++ b/charts/stable/handbrake/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [handbrake-10.0.7](https://github.com/truecharts/apps/compare/handbrake-10.0.6...handbrake-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [handbrake-10.0.6](https://github.com/truecharts/apps/compare/handbrake-10.0.5...handbrake-10.0.6) (2021-12-19) diff --git a/charts/stable/handbrake/README.md b/charts/stable/handbrake/README.md index a020883ea18..ee240a9e01f 100644 --- a/charts/stable/handbrake/README.md +++ b/charts/stable/handbrake/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/handbrake/security.md b/charts/stable/handbrake/security.md index 205b49d2c0e..ac07f1c79ee 100644 --- a/charts/stable/handbrake/security.md +++ b/charts/stable/handbrake/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/haste-server/CHANGELOG.md b/charts/stable/haste-server/CHANGELOG.md index 78ff3018fbd..2aaba5a0e48 100644 --- a/charts/stable/haste-server/CHANGELOG.md +++ b/charts/stable/haste-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [haste-server-4.0.26](https://github.com/truecharts/apps/compare/haste-server-4.0.25...haste-server-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [haste-server-4.0.25](https://github.com/truecharts/apps/compare/haste-server-4.0.24...haste-server-4.0.25) (2021-12-19) diff --git a/charts/stable/haste-server/README.md b/charts/stable/haste-server/README.md index 85b251548f7..a571fd3a48a 100644 --- a/charts/stable/haste-server/README.md +++ b/charts/stable/haste-server/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/haste-server/security.md b/charts/stable/haste-server/security.md index f41301954e3..c65c3738316 100644 --- a/charts/stable/haste-server/security.md +++ b/charts/stable/haste-server/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-haste-server' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -182,4 +179,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/headphones/CHANGELOG.md b/charts/stable/headphones/CHANGELOG.md index 3aab26b6798..c37feabb814 100644 --- a/charts/stable/headphones/CHANGELOG.md +++ b/charts/stable/headphones/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [headphones-2.0.26](https://github.com/truecharts/apps/compare/headphones-2.0.25...headphones-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [headphones-2.0.25](https://github.com/truecharts/apps/compare/headphones-2.0.24...headphones-2.0.25) (2021-12-19) diff --git a/charts/stable/headphones/README.md b/charts/stable/headphones/README.md index 11636ddb1de..de50e22f960 100644 --- a/charts/stable/headphones/README.md +++ b/charts/stable/headphones/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/headphones/security.md b/charts/stable/headphones/security.md index 1aa1c31eec6..f00ad000cef 100644 --- a/charts/stable/headphones/security.md +++ b/charts/stable/headphones/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/healthchecks/CHANGELOG.md b/charts/stable/healthchecks/CHANGELOG.md index 3468cde0f64..b8275f52caa 100644 --- a/charts/stable/healthchecks/CHANGELOG.md +++ b/charts/stable/healthchecks/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [healthchecks-5.0.7](https://github.com/truecharts/apps/compare/healthchecks-5.0.6...healthchecks-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [healthchecks-5.0.6](https://github.com/truecharts/apps/compare/healthchecks-5.0.5...healthchecks-5.0.6) (2021-12-19) diff --git a/charts/stable/healthchecks/README.md b/charts/stable/healthchecks/README.md index 096a2e4b7e4..64905404e45 100644 --- a/charts/stable/healthchecks/README.md +++ b/charts/stable/healthchecks/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/healthchecks/security.md b/charts/stable/healthchecks/security.md index 5d9c20ca240..aa65f96c481 100644 --- a/charts/stable/healthchecks/security.md +++ b/charts/stable/healthchecks/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/hedgedoc/CHANGELOG.md b/charts/stable/hedgedoc/CHANGELOG.md index 51b2bd8d527..02bed4d1222 100644 --- a/charts/stable/hedgedoc/CHANGELOG.md +++ b/charts/stable/hedgedoc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [hedgedoc-0.0.7](https://github.com/truecharts/apps/compare/hedgedoc-0.0.6...hedgedoc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [hedgedoc-0.0.6](https://github.com/truecharts/apps/compare/hedgedoc-0.0.5...hedgedoc-0.0.6) (2021-12-19) diff --git a/charts/stable/hedgedoc/README.md b/charts/stable/hedgedoc/README.md index aae024fe488..1b2510a642b 100644 --- a/charts/stable/hedgedoc/README.md +++ b/charts/stable/hedgedoc/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/hedgedoc/security.md b/charts/stable/hedgedoc/security.md index d6a57a37618..96419a49f6c 100644 --- a/charts/stable/hedgedoc/security.md +++ b/charts/stable/hedgedoc/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,10 +33,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,7 +47,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/hedgedoc:v1.9.2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -226,7 +219,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/heimdall/CHANGELOG.md b/charts/stable/heimdall/CHANGELOG.md index 4ee420ccd9f..2d734e91b22 100644 --- a/charts/stable/heimdall/CHANGELOG.md +++ b/charts/stable/heimdall/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [heimdall-9.0.31](https://github.com/truecharts/apps/compare/heimdall-9.0.30...heimdall-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [heimdall-9.0.30](https://github.com/truecharts/apps/compare/heimdall-9.0.29...heimdall-9.0.30) (2021-12-19) diff --git a/charts/stable/heimdall/README.md b/charts/stable/heimdall/README.md index 11bcd84404f..2520216120b 100644 --- a/charts/stable/heimdall/README.md +++ b/charts/stable/heimdall/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/heimdall/security.md b/charts/stable/heimdall/security.md index 4cc32f81f89..3c54095e3f2 100644 --- a/charts/stable/heimdall/security.md +++ b/charts/stable/heimdall/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/home-assistant/CHANGELOG.md b/charts/stable/home-assistant/CHANGELOG.md index 30832e72f1e..f6bffa9a968 100644 --- a/charts/stable/home-assistant/CHANGELOG.md +++ b/charts/stable/home-assistant/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [home-assistant-12.0.22](https://github.com/truecharts/apps/compare/home-assistant-12.0.21...home-assistant-12.0.22) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [home-assistant-12.0.21](https://github.com/truecharts/apps/compare/home-assistant-12.0.20...home-assistant-12.0.21) (2021-12-19) diff --git a/charts/stable/home-assistant/README.md b/charts/stable/home-assistant/README.md index faf10a89cd1..e51a235e793 100644 --- a/charts/stable/home-assistant/README.md +++ b/charts/stable/home-assistant/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/home-assistant/security.md b/charts/stable/home-assistant/security.md index 7e2012a4d67..d717619dc54 100644 --- a/charts/stable/home-assistant/security.md +++ b/charts/stable/home-assistant/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/home-assistant:v2021.12.3@sha256:aab517cd6a1e0d5fe86db447cfa032b4f9ede1567a60370d3ef4e564fd14576a' tccr.io/truecharts/home-assistant:v2021.12.3@sha256:aab517cd6a1e0d5fe86db447cfa032b4f9ede1567a60370d3ef4e564fd14576a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -454,7 +442,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/htpcmanager/CHANGELOG.md b/charts/stable/htpcmanager/CHANGELOG.md index 2e981c3f000..fbe650d3882 100644 --- a/charts/stable/htpcmanager/CHANGELOG.md +++ b/charts/stable/htpcmanager/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [htpcmanager-0.0.7](https://github.com/truecharts/apps/compare/htpcmanager-0.0.6...htpcmanager-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [htpcmanager-0.0.6](https://github.com/truecharts/apps/compare/htpcmanager-0.0.5...htpcmanager-0.0.6) (2021-12-19) diff --git a/charts/stable/htpcmanager/README.md b/charts/stable/htpcmanager/README.md index 8437be8e9e5..4668ac31153 100644 --- a/charts/stable/htpcmanager/README.md +++ b/charts/stable/htpcmanager/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/htpcmanager/security.md b/charts/stable/htpcmanager/security.md index ad8c6671678..893663a5781 100644 --- a/charts/stable/htpcmanager/security.md +++ b/charts/stable/htpcmanager/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/hyperion-ng/CHANGELOG.md b/charts/stable/hyperion-ng/CHANGELOG.md index fec9d907dd3..f551d0f9837 100644 --- a/charts/stable/hyperion-ng/CHANGELOG.md +++ b/charts/stable/hyperion-ng/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [hyperion-ng-4.0.29](https://github.com/truecharts/apps/compare/hyperion-ng-4.0.28...hyperion-ng-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [hyperion-ng-4.0.28](https://github.com/truecharts/apps/compare/hyperion-ng-4.0.27...hyperion-ng-4.0.28) (2021-12-19) diff --git a/charts/stable/hyperion-ng/README.md b/charts/stable/hyperion-ng/README.md index 35132a827de..411f119e336 100644 --- a/charts/stable/hyperion-ng/README.md +++ b/charts/stable/hyperion-ng/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/hyperion-ng/security.md b/charts/stable/hyperion-ng/security.md index 5f7192cda83..399f35c68b0 100644 --- a/charts/stable/hyperion-ng/security.md +++ b/charts/stable/hyperion-ng/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -252,7 +248,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -271,7 +267,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -281,13 +277,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -334,7 +332,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| diff --git a/charts/stable/icantbelieveitsnotvaletudo/CHANGELOG.md b/charts/stable/icantbelieveitsnotvaletudo/CHANGELOG.md index 5ca99d5ff42..e97c1fc7c79 100644 --- a/charts/stable/icantbelieveitsnotvaletudo/CHANGELOG.md +++ b/charts/stable/icantbelieveitsnotvaletudo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [icantbelieveitsnotvaletudo-2.0.26](https://github.com/truecharts/apps/compare/icantbelieveitsnotvaletudo-2.0.25...icantbelieveitsnotvaletudo-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [icantbelieveitsnotvaletudo-2.0.25](https://github.com/truecharts/apps/compare/icantbelieveitsnotvaletudo-2.0.24...icantbelieveitsnotvaletudo-2.0.25) (2021-12-19) diff --git a/charts/stable/icantbelieveitsnotvaletudo/README.md b/charts/stable/icantbelieveitsnotvaletudo/README.md index c438779043c..a9ba6d6993b 100644 --- a/charts/stable/icantbelieveitsnotvaletudo/README.md +++ b/charts/stable/icantbelieveitsnotvaletudo/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/icantbelieveitsnotvaletudo/security.md b/charts/stable/icantbelieveitsnotvaletudo/security.md index 477fd717960..158b882e351 100644 --- a/charts/stable/icantbelieveitsnotvaletudo/security.md +++ b/charts/stable/icantbelieveitsnotvaletudo/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/icinga2/CHANGELOG.md b/charts/stable/icinga2/CHANGELOG.md index 54287730ba0..dc7b9d7b90f 100644 --- a/charts/stable/icinga2/CHANGELOG.md +++ b/charts/stable/icinga2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [icinga2-0.0.15](https://github.com/truecharts/apps/compare/icinga2-0.0.14...icinga2-0.0.15) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [icinga2-0.0.14](https://github.com/truecharts/apps/compare/icinga2-0.0.13...icinga2-0.0.14) (2021-12-19) diff --git a/charts/stable/icinga2/README.md b/charts/stable/icinga2/README.md index 9bd78894eac..e34e7f7e3ac 100644 --- a/charts/stable/icinga2/README.md +++ b/charts/stable/icinga2/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/icinga2/security.md b/charts/stable/icinga2/security.md index 44bc9b9bf6a..f9d2c72dba8 100644 --- a/charts/stable/icinga2/security.md +++ b/charts/stable/icinga2/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/icinga2:v2.13.1@sha256:64116a1e267397888bcd6dd62b428322c81bf925f955867ada5207657a9d79db tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -103,6 +95,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -113,6 +107,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -123,6 +119,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -133,6 +131,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -1387,7 +1387,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/ipfs/CHANGELOG.md b/charts/stable/ipfs/CHANGELOG.md index 079b4421368..71795008acc 100644 --- a/charts/stable/ipfs/CHANGELOG.md +++ b/charts/stable/ipfs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ipfs-0.0.8](https://github.com/truecharts/apps/compare/ipfs-0.0.7...ipfs-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ipfs-0.0.7](https://github.com/truecharts/apps/compare/ipfs-0.0.6...ipfs-0.0.7) (2021-12-19) diff --git a/charts/stable/ipfs/README.md b/charts/stable/ipfs/README.md index d1c6c003f95..7cebf124269 100644 --- a/charts/stable/ipfs/README.md +++ b/charts/stable/ipfs/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/ipfs/security.md b/charts/stable/ipfs/security.md index 79b30072071..cedf586366a 100644 --- a/charts/stable/ipfs/security.md +++ b/charts/stable/ipfs/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -83,6 +80,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/ipfs/go-ipfs | CVE-2020-26283 | HIGH | v0.7.1-0.20210323141657-684b8b5bb7b0 | v0.8.0 |
Expand...https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
https://github.com/ipfs/go-ipfs/pull/7831
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm
https://nvd.nist.gov/vuln/detail/CVE-2020-26283
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200820211705-5c72a883971a | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/jackett/CHANGELOG.md b/charts/stable/jackett/CHANGELOG.md index 748dec4f4c8..ccb00f38bef 100644 --- a/charts/stable/jackett/CHANGELOG.md +++ b/charts/stable/jackett/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [jackett-9.0.54](https://github.com/truecharts/apps/compare/jackett-9.0.53...jackett-9.0.54) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [jackett-9.0.53](https://github.com/truecharts/apps/compare/jackett-9.0.52...jackett-9.0.53) (2021-12-20) diff --git a/charts/stable/jackett/README.md b/charts/stable/jackett/README.md index 007eb6dc06b..33578500a68 100644 --- a/charts/stable/jackett/README.md +++ b/charts/stable/jackett/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/jackett/helm-values.md b/charts/stable/jackett/helm-values.md index 575f0e06a9d..fb57cbd47f8 100644 --- a/charts/stable/jackett/helm-values.md +++ b/charts/stable/jackett/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/jackett"` | | -| image.tag | string | `"v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f"` | | +| image.tag | string | `"v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.path | string | `"/UI/Login"` | | diff --git a/charts/stable/jackett/security.md b/charts/stable/jackett/security.md index 63f5c2e41be..24f6aafe431 100644 --- a/charts/stable/jackett/security.md +++ b/charts/stable/jackett/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-jackett' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f + tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f (ubuntu 20.04) +#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 (ubuntu 20.04) **ubuntu** @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/jdownloader2/CHANGELOG.md b/charts/stable/jdownloader2/CHANGELOG.md index 9b879fa1e57..3c66098d2d8 100644 --- a/charts/stable/jdownloader2/CHANGELOG.md +++ b/charts/stable/jdownloader2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [jdownloader2-5.0.7](https://github.com/truecharts/apps/compare/jdownloader2-5.0.6...jdownloader2-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [jdownloader2-5.0.6](https://github.com/truecharts/apps/compare/jdownloader2-5.0.5...jdownloader2-5.0.6) (2021-12-19) diff --git a/charts/stable/jdownloader2/README.md b/charts/stable/jdownloader2/README.md index 61a7c1ae4e2..ab121eddd35 100644 --- a/charts/stable/jdownloader2/README.md +++ b/charts/stable/jdownloader2/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/jdownloader2/security.md b/charts/stable/jdownloader2/security.md index 1ab89b9cb34..fd3bd30612f 100644 --- a/charts/stable/jdownloader2/security.md +++ b/charts/stable/jdownloader2/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/jellyfin/CHANGELOG.md b/charts/stable/jellyfin/CHANGELOG.md index 859aea39cdd..227f0d41f93 100644 --- a/charts/stable/jellyfin/CHANGELOG.md +++ b/charts/stable/jellyfin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [jellyfin-9.0.27](https://github.com/truecharts/apps/compare/jellyfin-9.0.26...jellyfin-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [jellyfin-9.0.26](https://github.com/truecharts/apps/compare/jellyfin-9.0.25...jellyfin-9.0.26) (2021-12-19) diff --git a/charts/stable/jellyfin/README.md b/charts/stable/jellyfin/README.md index db5308fc00a..9b32199074c 100644 --- a/charts/stable/jellyfin/README.md +++ b/charts/stable/jellyfin/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/jellyfin/security.md b/charts/stable/jellyfin/security.md index 0ae18885354..64cade81d94 100644 --- a/charts/stable/jellyfin/security.md +++ b/charts/stable/jellyfin/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-jellyfin' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/joplin-server/CHANGELOG.md b/charts/stable/joplin-server/CHANGELOG.md index bf82ef18ac4..33c0a710e57 100644 --- a/charts/stable/joplin-server/CHANGELOG.md +++ b/charts/stable/joplin-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [joplin-server-5.0.17](https://github.com/truecharts/apps/compare/joplin-server-5.0.16...joplin-server-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [joplin-server-5.0.16](https://github.com/truecharts/apps/compare/joplin-server-5.0.15...joplin-server-5.0.16) (2021-12-19) diff --git a/charts/stable/joplin-server/README.md b/charts/stable/joplin-server/README.md index b8d8a2ae143..e043ca3ff31 100644 --- a/charts/stable/joplin-server/README.md +++ b/charts/stable/joplin-server/README.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/joplin-server/security.md b/charts/stable/joplin-server/security.md index fa8bc5315ac..1a0e0c6130c 100644 --- a/charts/stable/joplin-server/security.md +++ b/charts/stable/joplin-server/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/joplin-server:v2.5.1@sha256:a285ff0cf05f534efd28c6652925b57a9774ba41923d15536b873fbbdbabcd2b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -989,7 +979,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.46-5 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-5 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -1004,9 +994,9 @@ hide: | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-5 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -1018,15 +1008,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-5 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-5 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-5 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-5 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-5 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1071,7 +1063,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-5 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -1271,7 +1267,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/kanboard/CHANGELOG.md b/charts/stable/kanboard/CHANGELOG.md index aa710702025..462d82adf99 100644 --- a/charts/stable/kanboard/CHANGELOG.md +++ b/charts/stable/kanboard/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kanboard-5.0.18](https://github.com/truecharts/apps/compare/kanboard-5.0.17...kanboard-5.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kanboard-5.0.17](https://github.com/truecharts/apps/compare/kanboard-5.0.16...kanboard-5.0.17) (2021-12-19) diff --git a/charts/stable/kanboard/README.md b/charts/stable/kanboard/README.md index 1f8b0debebc..7b5d421723c 100644 --- a/charts/stable/kanboard/README.md +++ b/charts/stable/kanboard/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/kanboard/security.md b/charts/stable/kanboard/security.md index 470756e5b3b..6c4ee13581c 100644 --- a/charts/stable/kanboard/security.md +++ b/charts/stable/kanboard/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/kanboard:v1.2.21@sha256:49f497110c498e0911413082fec4103de068970769874804d6229bd1b0bfec51 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -361,7 +351,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/kms/CHANGELOG.md b/charts/stable/kms/CHANGELOG.md index 11fb6e73d1b..b8685119899 100644 --- a/charts/stable/kms/CHANGELOG.md +++ b/charts/stable/kms/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kms-9.0.31](https://github.com/truecharts/apps/compare/kms-9.0.30...kms-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kms-9.0.30](https://github.com/truecharts/apps/compare/kms-9.0.29...kms-9.0.30) (2021-12-19) diff --git a/charts/stable/kms/README.md b/charts/stable/kms/README.md index 5ed49563676..4f6491ffd55 100644 --- a/charts/stable/kms/README.md +++ b/charts/stable/kms/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/kms/security.md b/charts/stable/kms/security.md index 1c12b7a2eca..608caf168e4 100644 --- a/charts/stable/kms/security.md +++ b/charts/stable/kms/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/kodi-headless/CHANGELOG.md b/charts/stable/kodi-headless/CHANGELOG.md index 616da5783c8..a79e78f7c08 100644 --- a/charts/stable/kodi-headless/CHANGELOG.md +++ b/charts/stable/kodi-headless/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kodi-headless-0.0.8](https://github.com/truecharts/apps/compare/kodi-headless-0.0.7...kodi-headless-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kodi-headless-0.0.7](https://github.com/truecharts/apps/compare/kodi-headless-0.0.6...kodi-headless-0.0.7) (2021-12-19) diff --git a/charts/stable/kodi-headless/README.md b/charts/stable/kodi-headless/README.md index e52eafda959..24953c9238c 100644 --- a/charts/stable/kodi-headless/README.md +++ b/charts/stable/kodi-headless/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/kodi-headless/security.md b/charts/stable/kodi-headless/security.md index b87897af656..52f1e72930f 100644 --- a/charts/stable/kodi-headless/security.md +++ b/charts/stable/kodi-headless/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/komga/CHANGELOG.md b/charts/stable/komga/CHANGELOG.md index edf73c7e101..573a3011fa1 100644 --- a/charts/stable/komga/CHANGELOG.md +++ b/charts/stable/komga/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [komga-4.0.34](https://github.com/truecharts/apps/compare/komga-4.0.33...komga-4.0.34) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [komga-4.0.33](https://github.com/truecharts/apps/compare/komga-4.0.32...komga-4.0.33) (2021-12-19) diff --git a/charts/stable/komga/README.md b/charts/stable/komga/README.md index b5df4b51345..1e738a29d99 100644 --- a/charts/stable/komga/README.md +++ b/charts/stable/komga/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/komga/security.md b/charts/stable/komga/security.md index 21fb214bdd9..8b01a9bbf8a 100644 --- a/charts/stable/komga/security.md +++ b/charts/stable/komga/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-komga' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -280,8 +277,8 @@ hide: | org.apache.commons:commons-compress | CVE-2021-35517 | HIGH | 1.20 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/3
http://www.openwall.com/lists/oss-security/2021/07/13/5
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-xqfj-vm6h-2x34
https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46@%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-35517
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.commons:commons-compress | CVE-2021-36090 | HIGH | 1.20 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/4
http://www.openwall.com/lists/oss-security/2021/07/13/6
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-mc84-pj99-q6hh
https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-36090
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.14.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.14.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.14.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.14.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.14.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.pdfbox:pdfbox | CVE-2021-31811 | MEDIUM | 2.0.23 | 2.0.24 |
Expand...http://www.openwall.com/lists/oss-security/2021/06/12/2
https://github.com/advisories/GHSA-fg3j-q579-v8x4
https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e@%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/rf937c2236e6c79cdb99f76a70690dd345e53dbe0707cb506a202e43e@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/
https://nvd.nist.gov/vuln/detail/CVE-2021-31811
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.pdfbox:pdfbox | CVE-2021-31812 | MEDIUM | 2.0.23 | 2.0.24 |
Expand...http://www.openwall.com/lists/oss-security/2021/06/12/1
https://github.com/advisories/GHSA-7grw-6pjh-jpc9
https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e@%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/
https://nvd.nist.gov/vuln/detail/CVE-2021-31812
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.jgroups:jgroups | CVE-2016-2141 | CRITICAL | 3.6.13.Final | 4.0 |
Expand...http://rhn.redhat.com/errata/RHSA-2016-1435.html
http://rhn.redhat.com/errata/RHSA-2016-1439.html
http://rhn.redhat.com/errata/RHSA-2016-2035.html
http://www.securityfocus.com/bid/91481
http://www.securitytracker.com/id/1036165
https://access.redhat.com/articles/2360521
https://access.redhat.com/errata/RHSA-2016:1345
https://access.redhat.com/errata/RHSA-2016:1346
https://access.redhat.com/errata/RHSA-2016:1347
https://access.redhat.com/errata/RHSA-2016:1374
https://access.redhat.com/errata/RHSA-2016:1376
https://access.redhat.com/errata/RHSA-2016:1389
https://access.redhat.com/errata/RHSA-2016:1432
https://access.redhat.com/errata/RHSA-2016:1433
https://access.redhat.com/errata/RHSA-2016:1434
https://bugzilla.redhat.com/show_bug.cgi?id=1313589
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2141
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2141
https://issues.jboss.org/browse/JGRP-2021
https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E
https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E
https://rhn.redhat.com/errata/RHSA-2016-1328.html
https://rhn.redhat.com/errata/RHSA-2016-1329.html
https://rhn.redhat.com/errata/RHSA-2016-1330.html
https://rhn.redhat.com/errata/RHSA-2016-1331.html
https://rhn.redhat.com/errata/RHSA-2016-1332.html
https://rhn.redhat.com/errata/RHSA-2016-1333.html
https://rhn.redhat.com/errata/RHSA-2016-1334.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
| diff --git a/charts/stable/lazylibrarian/CHANGELOG.md b/charts/stable/lazylibrarian/CHANGELOG.md index 7b17888b56d..1a5d779b3c2 100644 --- a/charts/stable/lazylibrarian/CHANGELOG.md +++ b/charts/stable/lazylibrarian/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [lazylibrarian-9.0.35](https://github.com/truecharts/apps/compare/lazylibrarian-9.0.34...lazylibrarian-9.0.35) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [lazylibrarian-9.0.34](https://github.com/truecharts/apps/compare/lazylibrarian-9.0.33...lazylibrarian-9.0.34) (2021-12-20) diff --git a/charts/stable/lazylibrarian/README.md b/charts/stable/lazylibrarian/README.md index 159466f1ca6..f93a7c87744 100644 --- a/charts/stable/lazylibrarian/README.md +++ b/charts/stable/lazylibrarian/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/lazylibrarian/security.md b/charts/stable/lazylibrarian/security.md index 3485cfeb86f..b485ed1e2ae 100644 --- a/charts/stable/lazylibrarian/security.md +++ b/charts/stable/lazylibrarian/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/leaf2mqtt/CHANGELOG.md b/charts/stable/leaf2mqtt/CHANGELOG.md index da2b7525d7a..f3c327d7031 100644 --- a/charts/stable/leaf2mqtt/CHANGELOG.md +++ b/charts/stable/leaf2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [leaf2mqtt-2.0.26](https://github.com/truecharts/apps/compare/leaf2mqtt-2.0.25...leaf2mqtt-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [leaf2mqtt-2.0.25](https://github.com/truecharts/apps/compare/leaf2mqtt-2.0.24...leaf2mqtt-2.0.25) (2021-12-19) diff --git a/charts/stable/leaf2mqtt/README.md b/charts/stable/leaf2mqtt/README.md index b9227382934..bb6b13840d6 100644 --- a/charts/stable/leaf2mqtt/README.md +++ b/charts/stable/leaf2mqtt/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/leaf2mqtt/security.md b/charts/stable/leaf2mqtt/security.md index 6323bffb2b9..9350e7d2e36 100644 --- a/charts/stable/leaf2mqtt/security.md +++ b/charts/stable/leaf2mqtt/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/leantime/CHANGELOG.md b/charts/stable/leantime/CHANGELOG.md index b6a0e3203ac..e90d5cbfc62 100644 --- a/charts/stable/leantime/CHANGELOG.md +++ b/charts/stable/leantime/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [leantime-1.0.4](https://github.com/truecharts/apps/compare/leantime-1.0.3...leantime-1.0.4) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [leantime-1.0.3](https://github.com/truecharts/apps/compare/leantime-1.0.2...leantime-1.0.3) (2021-12-21) diff --git a/charts/stable/leantime/README.md b/charts/stable/leantime/README.md index 556eb5046b4..c8135a58e72 100644 --- a/charts/stable/leantime/README.md +++ b/charts/stable/leantime/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/leantime/security.md b/charts/stable/leantime/security.md index 9c6e72a2f1f..8cced8595ae 100644 --- a/charts/stable/leantime/security.md +++ b/charts/stable/leantime/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/leantime:v2.1.8@sha256:c2a5025fb6019f0fea9d3d8fb37a52f6a91a7d72117a081b759a1d0762dea513 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -246,7 +238,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/libreoffice/CHANGELOG.md b/charts/stable/libreoffice/CHANGELOG.md index 99589d86675..0de1ff9d30a 100644 --- a/charts/stable/libreoffice/CHANGELOG.md +++ b/charts/stable/libreoffice/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [libreoffice-0.0.7](https://github.com/truecharts/apps/compare/libreoffice-0.0.6...libreoffice-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [libreoffice-0.0.6](https://github.com/truecharts/apps/compare/libreoffice-0.0.5...libreoffice-0.0.6) (2021-12-19) diff --git a/charts/stable/libreoffice/README.md b/charts/stable/libreoffice/README.md index 999c1c664ec..4f7ffcc1965 100644 --- a/charts/stable/libreoffice/README.md +++ b/charts/stable/libreoffice/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/libreoffice/security.md b/charts/stable/libreoffice/security.md index 17998263a57..00e9b10f9ea 100644 --- a/charts/stable/libreoffice/security.md +++ b/charts/stable/libreoffice/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -94,10 +91,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -126,10 +122,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/librespeed/CHANGELOG.md b/charts/stable/librespeed/CHANGELOG.md index 82f93a3508c..7f646b734b9 100644 --- a/charts/stable/librespeed/CHANGELOG.md +++ b/charts/stable/librespeed/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [librespeed-4.0.30](https://github.com/truecharts/apps/compare/librespeed-4.0.29...librespeed-4.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [librespeed-4.0.29](https://github.com/truecharts/apps/compare/librespeed-4.0.28...librespeed-4.0.29) (2021-12-19) diff --git a/charts/stable/librespeed/README.md b/charts/stable/librespeed/README.md index b34d85819c8..352dcc1b678 100644 --- a/charts/stable/librespeed/README.md +++ b/charts/stable/librespeed/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/librespeed/security.md b/charts/stable/librespeed/security.md index 4f4d1d4a187..cd6faaec4e1 100644 --- a/charts/stable/librespeed/security.md +++ b/charts/stable/librespeed/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/lidarr/CHANGELOG.md b/charts/stable/lidarr/CHANGELOG.md index f9e57adf20a..552044ad20e 100644 --- a/charts/stable/lidarr/CHANGELOG.md +++ b/charts/stable/lidarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [lidarr-9.0.29](https://github.com/truecharts/apps/compare/lidarr-9.0.28...lidarr-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [lidarr-9.0.28](https://github.com/truecharts/apps/compare/lidarr-9.0.27...lidarr-9.0.28) (2021-12-20) diff --git a/charts/stable/lidarr/README.md b/charts/stable/lidarr/README.md index 52d04015a4f..bec5e2acc52 100644 --- a/charts/stable/lidarr/README.md +++ b/charts/stable/lidarr/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/lidarr/helm-values.md b/charts/stable/lidarr/helm-values.md index a97c07524c4..4dfecbf34ee 100644 --- a/charts/stable/lidarr/helm-values.md +++ b/charts/stable/lidarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/lidarr"` | | -| image.tag | string | `"v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444"` | | +| image.tag | string | `"v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/charts/stable/lidarr/security.md b/charts/stable/lidarr/security.md index bf4f7a94121..574f0400fb2 100644 --- a/charts/stable/lidarr/security.md +++ b/charts/stable/lidarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-lidarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444 + tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444 (ubuntu 20.04) +#### Container: tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c (ubuntu 20.04) **ubuntu** @@ -395,4 +392,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/littlelink/CHANGELOG.md b/charts/stable/littlelink/CHANGELOG.md index b387b7aab08..728bc5adfef 100644 --- a/charts/stable/littlelink/CHANGELOG.md +++ b/charts/stable/littlelink/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [littlelink-4.0.40](https://github.com/truecharts/apps/compare/littlelink-4.0.39...littlelink-4.0.40) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [littlelink-4.0.39](https://github.com/truecharts/apps/compare/littlelink-4.0.38...littlelink-4.0.39) (2021-12-19) diff --git a/charts/stable/littlelink/README.md b/charts/stable/littlelink/README.md index 50c77fa7d21..894c41c9b1f 100644 --- a/charts/stable/littlelink/README.md +++ b/charts/stable/littlelink/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/littlelink/security.md b/charts/stable/littlelink/security.md index bc3921edb07..2d123b6929e 100644 --- a/charts/stable/littlelink/security.md +++ b/charts/stable/littlelink/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-littlelink' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/logitech-media-server/CHANGELOG.md b/charts/stable/logitech-media-server/CHANGELOG.md index 4368f518f58..ff72323c19f 100644 --- a/charts/stable/logitech-media-server/CHANGELOG.md +++ b/charts/stable/logitech-media-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [logitech-media-server-2.0.37](https://github.com/truecharts/apps/compare/logitech-media-server-2.0.36...logitech-media-server-2.0.37) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [logitech-media-server-2.0.36](https://github.com/truecharts/apps/compare/logitech-media-server-2.0.35...logitech-media-server-2.0.36) (2021-12-19) diff --git a/charts/stable/logitech-media-server/README.md b/charts/stable/logitech-media-server/README.md index e26ee2ded9f..6a4e32778fd 100644 --- a/charts/stable/logitech-media-server/README.md +++ b/charts/stable/logitech-media-server/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/logitech-media-server/security.md b/charts/stable/logitech-media-server/security.md index f8e6c18df71..33df0097acf 100644 --- a/charts/stable/logitech-media-server/security.md +++ b/charts/stable/logitech-media-server/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/loki/CHANGELOG.md b/charts/stable/loki/CHANGELOG.md index b90b7c72d1f..1c1d9e8c4bd 100644 --- a/charts/stable/loki/CHANGELOG.md +++ b/charts/stable/loki/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [loki-2.0.14](https://github.com/truecharts/apps/compare/loki-2.0.13...loki-2.0.14) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [loki-2.0.13](https://github.com/truecharts/apps/compare/loki-2.0.12...loki-2.0.13) (2021-12-19) diff --git a/charts/stable/loki/README.md b/charts/stable/loki/README.md index 521c37857d2..7552e04c4bc 100644 --- a/charts/stable/loki/README.md +++ b/charts/stable/loki/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | promtail | 1.0.15 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | promtail | 1.0.17 | ## Installing the Chart diff --git a/charts/stable/loki/security.md b/charts/stable/loki/security.md index 927c5b38fd3..8919dc0024d 100644 --- a/charts/stable/loki/security.md +++ b/charts/stable/loki/security.md @@ -19,11 +19,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,15 +32,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

StatefulSet 'RELEASE-NAME-loki' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/lychee/CHANGELOG.md b/charts/stable/lychee/CHANGELOG.md index d36c3b3859e..02b3e820d71 100644 --- a/charts/stable/lychee/CHANGELOG.md +++ b/charts/stable/lychee/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [lychee-9.0.27](https://github.com/truecharts/apps/compare/lychee-9.0.26...lychee-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [lychee-9.0.26](https://github.com/truecharts/apps/compare/lychee-9.0.25...lychee-9.0.26) (2021-12-19) diff --git a/charts/stable/lychee/README.md b/charts/stable/lychee/README.md index a88ce69a4a8..aff0bc7a129 100644 --- a/charts/stable/lychee/README.md +++ b/charts/stable/lychee/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/lychee/security.md b/charts/stable/lychee/security.md index 3a25dd07dba..38fef79c5fa 100644 --- a/charts/stable/lychee/security.md +++ b/charts/stable/lychee/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -355,5 +351,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.42.1 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.42.1 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.2.9 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| diff --git a/charts/stable/mealie/CHANGELOG.md b/charts/stable/mealie/CHANGELOG.md index b35072a5f06..481d95ad11e 100644 --- a/charts/stable/mealie/CHANGELOG.md +++ b/charts/stable/mealie/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mealie-5.0.8](https://github.com/truecharts/apps/compare/mealie-5.0.7...mealie-5.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mealie-5.0.7](https://github.com/truecharts/apps/compare/mealie-5.0.6...mealie-5.0.7) (2021-12-19) diff --git a/charts/stable/mealie/README.md b/charts/stable/mealie/README.md index 8e5dce6742f..acaad27b302 100644 --- a/charts/stable/mealie/README.md +++ b/charts/stable/mealie/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/mealie/security.md b/charts/stable/mealie/security.md index 09e0eee7a35..27a5addef18 100644 --- a/charts/stable/mealie/security.md +++ b/charts/stable/mealie/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/mealie:v0.5.4@sha256:fcbbd8328e0eae400813319852e899c4270cc0fde1092d1f4adb6c0d23f02f03 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -464,7 +454,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/medusa/CHANGELOG.md b/charts/stable/medusa/CHANGELOG.md index 1e83ba8f562..d940a4c492c 100644 --- a/charts/stable/medusa/CHANGELOG.md +++ b/charts/stable/medusa/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [medusa-1.0.30](https://github.com/truecharts/apps/compare/medusa-1.0.29...medusa-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [medusa-1.0.29](https://github.com/truecharts/apps/compare/medusa-1.0.28...medusa-1.0.29) (2021-12-19) diff --git a/charts/stable/medusa/README.md b/charts/stable/medusa/README.md index ef88c7a7638..cb2177b2e61 100644 --- a/charts/stable/medusa/README.md +++ b/charts/stable/medusa/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/medusa/security.md b/charts/stable/medusa/security.md index b4e14562bb9..10b6e7d4989 100644 --- a/charts/stable/medusa/security.md +++ b/charts/stable/medusa/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/minetest/CHANGELOG.md b/charts/stable/minetest/CHANGELOG.md index d4702d0d3a0..595d2897236 100644 --- a/charts/stable/minetest/CHANGELOG.md +++ b/charts/stable/minetest/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minetest-0.0.7](https://github.com/truecharts/apps/compare/minetest-0.0.6...minetest-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minetest-0.0.6](https://github.com/truecharts/apps/compare/minetest-0.0.5...minetest-0.0.6) (2021-12-19) diff --git a/charts/stable/minetest/README.md b/charts/stable/minetest/README.md index 035588fff8f..0865b2eeeb2 100644 --- a/charts/stable/minetest/README.md +++ b/charts/stable/minetest/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/minetest/security.md b/charts/stable/minetest/security.md index ad9e619cdb5..5cd3b9fde06 100644 --- a/charts/stable/minetest/security.md +++ b/charts/stable/minetest/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/miniflux/CHANGELOG.md b/charts/stable/miniflux/CHANGELOG.md index a1f6cf88e48..9e65b231059 100644 --- a/charts/stable/miniflux/CHANGELOG.md +++ b/charts/stable/miniflux/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [miniflux-4.0.18](https://github.com/truecharts/apps/compare/miniflux-4.0.17...miniflux-4.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [miniflux-4.0.17](https://github.com/truecharts/apps/compare/miniflux-4.0.16...miniflux-4.0.17) (2021-12-19) diff --git a/charts/stable/miniflux/README.md b/charts/stable/miniflux/README.md index 6e252d69c0a..5de696c18f3 100644 --- a/charts/stable/miniflux/README.md +++ b/charts/stable/miniflux/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/miniflux/security.md b/charts/stable/miniflux/security.md index b814fe8ad9f..e2284479d72 100644 --- a/charts/stable/miniflux/security.md +++ b/charts/stable/miniflux/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-miniflux' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/miniflux:v2.0.34@sha256:38c0a023f8c60eea0b752b7b08170f8bd381ce0effdb406b6945201907edf81b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -331,6 +322,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -365,7 +357,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/minio-console/CHANGELOG.md b/charts/stable/minio-console/CHANGELOG.md index 74f57358b9b..37cf271eecb 100644 --- a/charts/stable/minio-console/CHANGELOG.md +++ b/charts/stable/minio-console/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minio-console-1.0.32](https://github.com/truecharts/apps/compare/minio-console-1.0.31...minio-console-1.0.32) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minio-console-1.0.31](https://github.com/truecharts/apps/compare/minio-console-1.0.30...minio-console-1.0.31) (2021-12-20) diff --git a/charts/stable/minio-console/README.md b/charts/stable/minio-console/README.md index e928dc4ec4a..9950882877f 100644 --- a/charts/stable/minio-console/README.md +++ b/charts/stable/minio-console/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/minio-console/security.md b/charts/stable/minio-console/security.md index c0150eea0b6..7fcfd8a46b7 100644 --- a/charts/stable/minio-console/security.md +++ b/charts/stable/minio-console/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-minio-console' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -147,5 +144,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| go.mongodb.org/mongo-driver | CVE-2021-20329 | MEDIUM | v1.4.6 | 1.5.1 |
Expand...https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
https://nvd.nist.gov/vuln/detail/CVE-2021-20329
| diff --git a/charts/stable/minio/CHANGELOG.md b/charts/stable/minio/CHANGELOG.md index 754bb1f8836..2ad42f73377 100644 --- a/charts/stable/minio/CHANGELOG.md +++ b/charts/stable/minio/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minio-1.0.14](https://github.com/truecharts/apps/compare/minio-console-1.0.31...minio-1.0.14) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minio-1.0.13](https://github.com/truecharts/apps/compare/minio-1.0.12...minio-1.0.13) (2021-12-19) diff --git a/charts/stable/minio/README.md b/charts/stable/minio/README.md index 8480509fbff..a9e928aecc7 100644 --- a/charts/stable/minio/README.md +++ b/charts/stable/minio/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/minio/security.md b/charts/stable/minio/security.md index bf930f56b80..0116881755f 100644 --- a/charts/stable/minio/security.md +++ b/charts/stable/minio/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-minio' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/minisatip/CHANGELOG.md b/charts/stable/minisatip/CHANGELOG.md index 9def4ad927d..20a01f7426d 100644 --- a/charts/stable/minisatip/CHANGELOG.md +++ b/charts/stable/minisatip/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minisatip-0.0.8](https://github.com/truecharts/apps/compare/minisatip-0.0.7...minisatip-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minisatip-0.0.7](https://github.com/truecharts/apps/compare/minisatip-0.0.6...minisatip-0.0.7) (2021-12-19) diff --git a/charts/stable/minisatip/README.md b/charts/stable/minisatip/README.md index 07b2a40b213..e940f47173b 100644 --- a/charts/stable/minisatip/README.md +++ b/charts/stable/minisatip/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/minisatip/security.md b/charts/stable/minisatip/security.md index 922683e7d03..f1d9bf058c3 100644 --- a/charts/stable/minisatip/security.md +++ b/charts/stable/minisatip/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/monica/CHANGELOG.md b/charts/stable/monica/CHANGELOG.md index 30b5df4f93d..f1e2a40f520 100644 --- a/charts/stable/monica/CHANGELOG.md +++ b/charts/stable/monica/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [monica-0.0.18](https://github.com/truecharts/apps/compare/monica-0.0.17...monica-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [monica-0.0.17](https://github.com/truecharts/apps/compare/monica-0.0.16...monica-0.0.17) (2021-12-19) diff --git a/charts/stable/monica/README.md b/charts/stable/monica/README.md index 251f0f895a5..40f8d8706c5 100644 --- a/charts/stable/monica/README.md +++ b/charts/stable/monica/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/monica/security.md b/charts/stable/monica/security.md index 10772e553d1..2fbc2d19077 100644 --- a/charts/stable/monica/security.md +++ b/charts/stable/monica/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/monica:v3.5.0@sha256:db2c8518d1c5c664b8f7cbb86f275739e3c68bff2fc9771a066afe45773dff44 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,6 +93,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -109,6 +103,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -117,6 +113,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -125,6 +123,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -364,7 +364,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -376,7 +376,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -386,15 +386,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -437,7 +439,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -468,7 +474,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | doctrine/dbal | CVE-2021-43608 | CRITICAL | 3.1.3 | 3.0.99, 3.1.4 |
Expand...https://github.com/advisories/GHSA-r7cj-8hjg-x622
https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
https://github.com/doctrine/dbal/releases
https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
https://nvd.nist.gov/vuln/detail/CVE-2021-43608
https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html
| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.68.1 | 8.75.0, 6.20.42, 7.30.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.68.1 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.3.10 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| @@ -504,7 +510,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/mosquitto/CHANGELOG.md b/charts/stable/mosquitto/CHANGELOG.md index 8480e515fec..b0374462be7 100644 --- a/charts/stable/mosquitto/CHANGELOG.md +++ b/charts/stable/mosquitto/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mosquitto-4.0.28](https://github.com/truecharts/apps/compare/mosquitto-4.0.27...mosquitto-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mosquitto-4.0.27](https://github.com/truecharts/apps/compare/mosquitto-4.0.26...mosquitto-4.0.27) (2021-12-19) diff --git a/charts/stable/mosquitto/README.md b/charts/stable/mosquitto/README.md index a14be77c476..9038b6e112d 100644 --- a/charts/stable/mosquitto/README.md +++ b/charts/stable/mosquitto/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/mosquitto/security.md b/charts/stable/mosquitto/security.md index c01c06438b7..8faf7281f06 100644 --- a/charts/stable/mosquitto/security.md +++ b/charts/stable/mosquitto/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-mosquitto' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/mstream/CHANGELOG.md b/charts/stable/mstream/CHANGELOG.md index 50fc34ca2e4..09636f46ad6 100644 --- a/charts/stable/mstream/CHANGELOG.md +++ b/charts/stable/mstream/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mstream-1.0.26](https://github.com/truecharts/apps/compare/mstream-1.0.25...mstream-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mstream-1.0.25](https://github.com/truecharts/apps/compare/mstream-1.0.24...mstream-1.0.25) (2021-12-19) diff --git a/charts/stable/mstream/README.md b/charts/stable/mstream/README.md index 36c993a57bb..0658c34bfaa 100644 --- a/charts/stable/mstream/README.md +++ b/charts/stable/mstream/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/mstream/security.md b/charts/stable/mstream/security.md index bc1b98d8ce1..6769913f9b1 100644 --- a/charts/stable/mstream/security.md +++ b/charts/stable/mstream/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/muximux/CHANGELOG.md b/charts/stable/muximux/CHANGELOG.md index dda80ba4b5e..ed7249b0918 100644 --- a/charts/stable/muximux/CHANGELOG.md +++ b/charts/stable/muximux/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [muximux-1.0.30](https://github.com/truecharts/apps/compare/muximux-1.0.29...muximux-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [muximux-1.0.29](https://github.com/truecharts/apps/compare/muximux-1.0.28...muximux-1.0.29) (2021-12-19) diff --git a/charts/stable/muximux/README.md b/charts/stable/muximux/README.md index 3359cdaa292..7dca4fa94f0 100644 --- a/charts/stable/muximux/README.md +++ b/charts/stable/muximux/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/muximux/security.md b/charts/stable/muximux/security.md index 3cddd130381..ca0fe761c0d 100644 --- a/charts/stable/muximux/security.md +++ b/charts/stable/muximux/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/mylar/CHANGELOG.md b/charts/stable/mylar/CHANGELOG.md index e6bd0fe36ec..92ba5365877 100644 --- a/charts/stable/mylar/CHANGELOG.md +++ b/charts/stable/mylar/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mylar-4.0.26](https://github.com/truecharts/apps/compare/mylar-4.0.25...mylar-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mylar-4.0.25](https://github.com/truecharts/apps/compare/mylar-4.0.24...mylar-4.0.25) (2021-12-19) diff --git a/charts/stable/mylar/README.md b/charts/stable/mylar/README.md index 4d4e34fb247..f919ca5b67c 100644 --- a/charts/stable/mylar/README.md +++ b/charts/stable/mylar/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/mylar/security.md b/charts/stable/mylar/security.md index 32f3679140b..50db16729be 100644 --- a/charts/stable/mylar/security.md +++ b/charts/stable/mylar/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/mysql-workbench/CHANGELOG.md b/charts/stable/mysql-workbench/CHANGELOG.md index a5ec9e0b61a..0fc7f190c64 100644 --- a/charts/stable/mysql-workbench/CHANGELOG.md +++ b/charts/stable/mysql-workbench/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mysql-workbench-0.0.7](https://github.com/truecharts/apps/compare/mysql-workbench-0.0.6...mysql-workbench-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mysql-workbench-0.0.6](https://github.com/truecharts/apps/compare/mysql-workbench-0.0.5...mysql-workbench-0.0.6) (2021-12-19) diff --git a/charts/stable/mysql-workbench/README.md b/charts/stable/mysql-workbench/README.md index acbec4594f6..931da237e73 100644 --- a/charts/stable/mysql-workbench/README.md +++ b/charts/stable/mysql-workbench/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/mysql-workbench/security.md b/charts/stable/mysql-workbench/security.md index 2082480091f..5b98650351d 100644 --- a/charts/stable/mysql-workbench/security.md +++ b/charts/stable/mysql-workbench/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -217,3 +214,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/nano-wallet/CHANGELOG.md b/charts/stable/nano-wallet/CHANGELOG.md index 2cc8d7067c5..ffaa532490b 100644 --- a/charts/stable/nano-wallet/CHANGELOG.md +++ b/charts/stable/nano-wallet/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nano-wallet-0.0.9](https://github.com/truecharts/apps/compare/nano-wallet-0.0.8...nano-wallet-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nano-wallet-0.0.8](https://github.com/truecharts/apps/compare/nano-wallet-0.0.7...nano-wallet-0.0.8) (2021-12-19) diff --git a/charts/stable/nano-wallet/README.md b/charts/stable/nano-wallet/README.md index 6323bf92810..6013c3d1e64 100644 --- a/charts/stable/nano-wallet/README.md +++ b/charts/stable/nano-wallet/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/nano-wallet/security.md b/charts/stable/nano-wallet/security.md index f75ef23cfe5..029bd098c45 100644 --- a/charts/stable/nano-wallet/security.md +++ b/charts/stable/nano-wallet/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/navidrome/CHANGELOG.md b/charts/stable/navidrome/CHANGELOG.md index 31581ba724b..3471073d7aa 100644 --- a/charts/stable/navidrome/CHANGELOG.md +++ b/charts/stable/navidrome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [navidrome-9.0.27](https://github.com/truecharts/apps/compare/navidrome-9.0.26...navidrome-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [navidrome-9.0.26](https://github.com/truecharts/apps/compare/navidrome-9.0.25...navidrome-9.0.26) (2021-12-19) diff --git a/charts/stable/navidrome/README.md b/charts/stable/navidrome/README.md index 1211687f0a5..cea3a379766 100644 --- a/charts/stable/navidrome/README.md +++ b/charts/stable/navidrome/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/navidrome/security.md b/charts/stable/navidrome/security.md index 7a39ced3fe2..6420b76f2b8 100644 --- a/charts/stable/navidrome/security.md +++ b/charts/stable/navidrome/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-navidrome' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -85,5 +82,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/charts/stable/nextcloud/CHANGELOG.md b/charts/stable/nextcloud/CHANGELOG.md index 9244a777e31..6ab723ff5c7 100644 --- a/charts/stable/nextcloud/CHANGELOG.md +++ b/charts/stable/nextcloud/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nextcloud-11.0.8](https://github.com/truecharts/apps/compare/nextcloud-11.0.7...nextcloud-11.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nextcloud-11.0.7](https://github.com/truecharts/apps/compare/nextcloud-11.0.6...nextcloud-11.0.7) (2021-12-19) diff --git a/charts/stable/nextcloud/README.md b/charts/stable/nextcloud/README.md index 513e68acdae..f976190e638 100644 --- a/charts/stable/nextcloud/README.md +++ b/charts/stable/nextcloud/README.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/nextcloud/security.md b/charts/stable/nextcloud/security.md index 36a4ac63af9..9e195a67c4e 100644 --- a/charts/stable/nextcloud/security.md +++ b/charts/stable/nextcloud/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -59,18 +51,10 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -86,13 +70,13 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/nextcloud:v23.0.0@sha256:08937edce142d8bf675d5b2f8960fe91433fb59b209248f02742c784446d8b59 tccr.io/truecharts/nextcloud:v23.0.0@sha256:08937edce142d8bf675d5b2f8960fe91433fb59b209248f02742c784446d8b59 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -129,7 +113,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -353,6 +337,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -361,6 +347,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -369,6 +357,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -377,6 +367,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -717,7 +709,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -729,7 +721,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -739,15 +731,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -790,7 +784,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -864,6 +862,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -872,6 +872,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -880,6 +882,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -888,6 +892,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -1228,7 +1234,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -1240,7 +1246,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -1250,15 +1256,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1301,7 +1309,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -1399,7 +1411,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1647,7 +1659,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/ngircd/CHANGELOG.md b/charts/stable/ngircd/CHANGELOG.md index 521fd4b22d1..369a9232ae8 100644 --- a/charts/stable/ngircd/CHANGELOG.md +++ b/charts/stable/ngircd/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ngircd-0.0.7](https://github.com/truecharts/apps/compare/ngircd-0.0.6...ngircd-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ngircd-0.0.6](https://github.com/truecharts/apps/compare/ngircd-0.0.5...ngircd-0.0.6) (2021-12-19) diff --git a/charts/stable/ngircd/README.md b/charts/stable/ngircd/README.md index 7b87da22329..b0d07a8065a 100644 --- a/charts/stable/ngircd/README.md +++ b/charts/stable/ngircd/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/ngircd/security.md b/charts/stable/ngircd/security.md index 28fc7c6d6e7..8b0ca99f3a8 100644 --- a/charts/stable/ngircd/security.md +++ b/charts/stable/ngircd/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/nntp2nntp/CHANGELOG.md b/charts/stable/nntp2nntp/CHANGELOG.md index 3ec882a3cfe..023dd071b6f 100644 --- a/charts/stable/nntp2nntp/CHANGELOG.md +++ b/charts/stable/nntp2nntp/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nntp2nntp-0.0.7](https://github.com/truecharts/apps/compare/nntp2nntp-0.0.6...nntp2nntp-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nntp2nntp-0.0.6](https://github.com/truecharts/apps/compare/nntp2nntp-0.0.5...nntp2nntp-0.0.6) (2021-12-19) diff --git a/charts/stable/nntp2nntp/README.md b/charts/stable/nntp2nntp/README.md index 24e84f34a29..562422fe426 100644 --- a/charts/stable/nntp2nntp/README.md +++ b/charts/stable/nntp2nntp/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/nntp2nntp/security.md b/charts/stable/nntp2nntp/security.md index 734a183bfe0..14dba0dc0f6 100644 --- a/charts/stable/nntp2nntp/security.md +++ b/charts/stable/nntp2nntp/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/node-red/CHANGELOG.md b/charts/stable/node-red/CHANGELOG.md index fd6a9644892..924a06b066a 100644 --- a/charts/stable/node-red/CHANGELOG.md +++ b/charts/stable/node-red/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [node-red-9.0.27](https://github.com/truecharts/apps/compare/node-red-9.0.26...node-red-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [node-red-9.0.26](https://github.com/truecharts/apps/compare/node-red-9.0.25...node-red-9.0.26) (2021-12-19) diff --git a/charts/stable/node-red/README.md b/charts/stable/node-red/README.md index e2ab9639f82..b0d0fc453c2 100644 --- a/charts/stable/node-red/README.md +++ b/charts/stable/node-red/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/node-red/security.md b/charts/stable/node-red/security.md index 94ae953aae7..aae48f77769 100644 --- a/charts/stable/node-red/security.md +++ b/charts/stable/node-red/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-node-red' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/novnc/CHANGELOG.md b/charts/stable/novnc/CHANGELOG.md index 1979fc06c2c..03898f11f07 100644 --- a/charts/stable/novnc/CHANGELOG.md +++ b/charts/stable/novnc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [novnc-1.0.26](https://github.com/truecharts/apps/compare/novnc-1.0.25...novnc-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [novnc-1.0.25](https://github.com/truecharts/apps/compare/novnc-1.0.24...novnc-1.0.25) (2021-12-19) diff --git a/charts/stable/novnc/README.md b/charts/stable/novnc/README.md index f11f9de1cb3..5ef0de9c655 100644 --- a/charts/stable/novnc/README.md +++ b/charts/stable/novnc/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/novnc/security.md b/charts/stable/novnc/security.md index d6705460a21..acd1dcb29f5 100644 --- a/charts/stable/novnc/security.md +++ b/charts/stable/novnc/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/nullserv/CHANGELOG.md b/charts/stable/nullserv/CHANGELOG.md index d4b9697292d..63bcc4075e1 100644 --- a/charts/stable/nullserv/CHANGELOG.md +++ b/charts/stable/nullserv/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nullserv-4.0.26](https://github.com/truecharts/apps/compare/nullserv-4.0.25...nullserv-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nullserv-4.0.25](https://github.com/truecharts/apps/compare/nullserv-4.0.24...nullserv-4.0.25) (2021-12-19) diff --git a/charts/stable/nullserv/README.md b/charts/stable/nullserv/README.md index 4ca086bbb0a..568aada1794 100644 --- a/charts/stable/nullserv/README.md +++ b/charts/stable/nullserv/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/nullserv/security.md b/charts/stable/nullserv/security.md index a71caacfd13..0fdd198adaf 100644 --- a/charts/stable/nullserv/security.md +++ b/charts/stable/nullserv/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/nzbget/CHANGELOG.md b/charts/stable/nzbget/CHANGELOG.md index 9d269f863a6..c2d2aaef356 100644 --- a/charts/stable/nzbget/CHANGELOG.md +++ b/charts/stable/nzbget/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [nzbget-9.0.27](https://github.com/truecharts/apps/compare/nzbget-9.0.26...nzbget-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [nzbget-9.0.26](https://github.com/truecharts/apps/compare/nzbget-9.0.25...nzbget-9.0.26) (2021-12-19) diff --git a/charts/stable/nzbget/README.md b/charts/stable/nzbget/README.md index 25ed0343f08..a4e1d86c817 100644 --- a/charts/stable/nzbget/README.md +++ b/charts/stable/nzbget/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/nzbget/helm-values.md b/charts/stable/nzbget/helm-values.md index 77fd771761c..a287ac48998 100644 --- a/charts/stable/nzbget/helm-values.md +++ b/charts/stable/nzbget/helm-values.md @@ -13,7 +13,7 @@ You will, however, be able to use all values referenced in the common chart here |-----|------|---------|-------------| | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/nzbget"` | | -| image.tag | string | `"v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a"` | | +| image.tag | string | `"v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.enabled | bool | `false` | | diff --git a/charts/stable/nzbget/security.md b/charts/stable/nzbget/security.md index b751c050617..ca1fa305aad 100644 --- a/charts/stable/nzbget/security.md +++ b/charts/stable/nzbget/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-nzbget' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/nzbget:v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a + tccr.io/truecharts/nzbget:v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/nzbget:v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a (ubuntu 20.04) +#### Container: tccr.io/truecharts/nzbget:v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -125,10 +117,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -148,23 +140,26 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| -| wget | CVE-2021-31879 | MEDIUM | 1.20.3-1ubuntu1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31879
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html
https://savannah.gnu.org/bugs/?56909
https://security.netapp.com/advisory/ntap-20210618-0002/
| +| wget | CVE-2021-31879 | MEDIUM | 1.20.3-1ubuntu2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31879
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html
https://savannah.gnu.org/bugs/?56909
https://security.netapp.com/advisory/ntap-20210618-0002/
| **python-pkg** -| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | -|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| lxml | CVE-2021-43818 | HIGH | 4.6.4 | 4.6.5 |
Expand...https://github.com/advisories/GHSA-55x5-fj6c-h6m8
https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
https://nvd.nist.gov/vuln/detail/CVE-2021-43818
| +| No Vulnerabilities found | +|:---------------------------------| + + **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/nzbhydra/CHANGELOG.md b/charts/stable/nzbhydra/CHANGELOG.md index 60aa677ed1c..c62e6310ce3 100644 --- a/charts/stable/nzbhydra/CHANGELOG.md +++ b/charts/stable/nzbhydra/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [nzbhydra-9.0.30](https://github.com/truecharts/apps/compare/nzbhydra-9.0.29...nzbhydra-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [nzbhydra-9.0.29](https://github.com/truecharts/apps/compare/nzbhydra-9.0.28...nzbhydra-9.0.29) (2021-12-19) diff --git a/charts/stable/nzbhydra/README.md b/charts/stable/nzbhydra/README.md index dbcef244a9e..8efe483fd06 100644 --- a/charts/stable/nzbhydra/README.md +++ b/charts/stable/nzbhydra/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/nzbhydra/helm-values.md b/charts/stable/nzbhydra/helm-values.md index 23bcd163e7d..5ca79a94f55 100644 --- a/charts/stable/nzbhydra/helm-values.md +++ b/charts/stable/nzbhydra/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/nzbhydra2"` | | -| image.tag | string | `"v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f"` | | +| image.tag | string | `"v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/charts/stable/nzbhydra/security.md b/charts/stable/nzbhydra/security.md index 4cabf5de735..35462362869 100644 --- a/charts/stable/nzbhydra/security.md +++ b/charts/stable/nzbhydra/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-nzbhydra' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f + tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f (ubuntu 20.04) +#### Container: tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5 (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -118,7 +111,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libjpeg-turbo8 | CVE-2020-17541 | LOW | 2.0.3-0ubuntu1.20.04.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17541
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
https://linux.oracle.com/cve/CVE-2020-17541.html
https://linux.oracle.com/errata/ELSA-2021-4288.html
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| @@ -131,12 +123,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -154,31 +144,18 @@ hide: | locales | CVE-2021-3326 | LOW | 2.31-0ubuntu9.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/01/28/2
https://bugs.chromium.org/p/project-zero/issues/detail?id=2146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326
https://linux.oracle.com/cve/CVE-2021-3326.html
https://linux.oracle.com/errata/ELSA-2021-9344.html
https://security.netapp.com/advisory/ntap-20210304-0007/
https://sourceware.org/bugzilla/show_bug.cgi?id=27256
https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html
| | locales | CVE-2021-33574 | LOW | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| -| openjdk-11-jre-headless | CVE-2021-2341 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2341
https://linux.oracle.com/cve/CVE-2021-2341.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/java/technologies/javase/11-0-12-relnotes.html
https://www.oracle.com/java/technologies/javase/8u301-relnotes.html
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-2369 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2369
https://linux.oracle.com/cve/CVE-2021-2369.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-2388 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2388
https://linux.oracle.com/cve/CVE-2021-2388.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35550 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35550
https://linux.oracle.com/cve/CVE-2021-35550.html
https://linux.oracle.com/errata/ELSA-2021-3893.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35556 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35556
https://linux.oracle.com/cve/CVE-2021-35556.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35559 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35559
https://linux.oracle.com/cve/CVE-2021-35559.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35561 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35561
https://linux.oracle.com/cve/CVE-2021-35561.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35564 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35564
https://linux.oracle.com/cve/CVE-2021-35564.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35565 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35565
https://linux.oracle.com/cve/CVE-2021-35565.html
https://linux.oracle.com/errata/ELSA-2021-3893.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35567 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35567
https://linux.oracle.com/cve/CVE-2021-35567.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35578 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35578
https://linux.oracle.com/cve/CVE-2021-35578.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35586 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35586
https://linux.oracle.com/cve/CVE-2021-35586.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35603 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35603
https://linux.oracle.com/cve/CVE-2021-35603.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/octoprint/CHANGELOG.md b/charts/stable/octoprint/CHANGELOG.md index b2d96643f5e..ca595a86de1 100644 --- a/charts/stable/octoprint/CHANGELOG.md +++ b/charts/stable/octoprint/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [octoprint-4.0.28](https://github.com/truecharts/apps/compare/octoprint-4.0.27...octoprint-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [octoprint-4.0.27](https://github.com/truecharts/apps/compare/octoprint-4.0.26...octoprint-4.0.27) (2021-12-19) diff --git a/charts/stable/octoprint/README.md b/charts/stable/octoprint/README.md index 068f9aaa9f3..8492a0c7f74 100644 --- a/charts/stable/octoprint/README.md +++ b/charts/stable/octoprint/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/octoprint/security.md b/charts/stable/octoprint/security.md index 30d15911234..7941d98f9cb 100644 --- a/charts/stable/octoprint/security.md +++ b/charts/stable/octoprint/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -1366,7 +1362,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -1385,7 +1381,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -1395,13 +1391,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1448,7 +1446,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| diff --git a/charts/stable/odoo/CHANGELOG.md b/charts/stable/odoo/CHANGELOG.md index 3ba85b708e0..e3949a5577b 100644 --- a/charts/stable/odoo/CHANGELOG.md +++ b/charts/stable/odoo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [odoo-4.0.17](https://github.com/truecharts/apps/compare/odoo-4.0.16...odoo-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [odoo-4.0.16](https://github.com/truecharts/apps/compare/odoo-4.0.15...odoo-4.0.16) (2021-12-19) diff --git a/charts/stable/odoo/README.md b/charts/stable/odoo/README.md index 4494533adb8..12cf887ee7f 100644 --- a/charts/stable/odoo/README.md +++ b/charts/stable/odoo/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/odoo/security.md b/charts/stable/odoo/security.md index 418eba6a69a..5e3b53b575e 100644 --- a/charts/stable/odoo/security.md +++ b/charts/stable/odoo/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-odoo' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/odoo:version-14.0@sha256:dec23986ced979e029a78512272e2be18bab60d811bccb3d7ddc4b3241b210e2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -748,7 +739,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/ombi/CHANGELOG.md b/charts/stable/ombi/CHANGELOG.md index c33f892cf9b..3b8b32a73a9 100644 --- a/charts/stable/ombi/CHANGELOG.md +++ b/charts/stable/ombi/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ombi-9.0.29](https://github.com/truecharts/apps/compare/ombi-9.0.28...ombi-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ombi-9.0.28](https://github.com/truecharts/apps/compare/ombi-9.0.27...ombi-9.0.28) (2021-12-19) diff --git a/charts/stable/ombi/README.md b/charts/stable/ombi/README.md index 4aab23908e4..e0c6369e220 100644 --- a/charts/stable/ombi/README.md +++ b/charts/stable/ombi/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/ombi/security.md b/charts/stable/ombi/security.md index bf6bd4268c6..307b8d742ea 100644 --- a/charts/stable/ombi/security.md +++ b/charts/stable/ombi/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-ombi' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/onlyoffice-document-server/CHANGELOG.md b/charts/stable/onlyoffice-document-server/CHANGELOG.md index 2ccab3c2f8c..f02142ad2e6 100644 --- a/charts/stable/onlyoffice-document-server/CHANGELOG.md +++ b/charts/stable/onlyoffice-document-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [onlyoffice-document-server-3.0.7](https://github.com/truecharts/apps/compare/onlyoffice-document-server-3.0.6...onlyoffice-document-server-3.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [onlyoffice-document-server-3.0.6](https://github.com/truecharts/apps/compare/onlyoffice-document-server-3.0.5...onlyoffice-document-server-3.0.6) (2021-12-19) diff --git a/charts/stable/onlyoffice-document-server/README.md b/charts/stable/onlyoffice-document-server/README.md index 7453252e551..c107a982b96 100644 --- a/charts/stable/onlyoffice-document-server/README.md +++ b/charts/stable/onlyoffice-document-server/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/onlyoffice-document-server/security.md b/charts/stable/onlyoffice-document-server/security.md index e7fe51fc532..8c9c63abf6e 100644 --- a/charts/stable/onlyoffice-document-server/security.md +++ b/charts/stable/onlyoffice-document-server/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/openkm/CHANGELOG.md b/charts/stable/openkm/CHANGELOG.md index a5ab1a77ac9..505c3d445f7 100644 --- a/charts/stable/openkm/CHANGELOG.md +++ b/charts/stable/openkm/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openkm-4.0.17](https://github.com/truecharts/apps/compare/openkm-4.0.16...openkm-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openkm-4.0.16](https://github.com/truecharts/apps/compare/openkm-4.0.15...openkm-4.0.16) (2021-12-19) diff --git a/charts/stable/openkm/README.md b/charts/stable/openkm/README.md index 4c2803ae8b8..6004155181a 100644 --- a/charts/stable/openkm/README.md +++ b/charts/stable/openkm/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/openkm/security.md b/charts/stable/openkm/security.md index 9508eaf56fb..e3fa99d3128 100644 --- a/charts/stable/openkm/security.md +++ b/charts/stable/openkm/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c' tccr.io/truecharts/openkm-ce:v6.3.11@sha256:941156f70c16350fb92d66f60007ac68abaee11265448eaacc40e821a46afc4d tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -973,7 +961,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/openldap/CHANGELOG.md b/charts/stable/openldap/CHANGELOG.md index ca01251aad1..88e3af50d99 100644 --- a/charts/stable/openldap/CHANGELOG.md +++ b/charts/stable/openldap/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openldap-5.0.9](https://github.com/truecharts/apps/compare/openldap-5.0.8...openldap-5.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openldap-5.0.8](https://github.com/truecharts/apps/compare/openldap-5.0.7...openldap-5.0.8) (2021-12-19) diff --git a/charts/stable/openldap/README.md b/charts/stable/openldap/README.md index f27ffd82cb3..fc22803e0b5 100644 --- a/charts/stable/openldap/README.md +++ b/charts/stable/openldap/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/openldap/security.md b/charts/stable/openldap/security.md index 321fb6f7404..c5492f55cee 100644 --- a/charts/stable/openldap/security.md +++ b/charts/stable/openldap/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -449,6 +445,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20201012173705-84dcc777aaee | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -456,3 +453,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20201012173705-84dcc777aaee | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/charts/stable/openvscode-server/CHANGELOG.md b/charts/stable/openvscode-server/CHANGELOG.md index 9eaa0c3b756..a9ff006349d 100644 --- a/charts/stable/openvscode-server/CHANGELOG.md +++ b/charts/stable/openvscode-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openvscode-server-0.0.8](https://github.com/truecharts/apps/compare/openvscode-server-0.0.7...openvscode-server-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openvscode-server-0.0.7](https://github.com/truecharts/apps/compare/openvscode-server-0.0.6...openvscode-server-0.0.7) (2021-12-19) diff --git a/charts/stable/openvscode-server/README.md b/charts/stable/openvscode-server/README.md index abd1dd4a8eb..8e0b600e8fa 100644 --- a/charts/stable/openvscode-server/README.md +++ b/charts/stable/openvscode-server/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/openvscode-server/security.md b/charts/stable/openvscode-server/security.md index d5fd264adc7..e4036c93dde 100644 --- a/charts/stable/openvscode-server/security.md +++ b/charts/stable/openvscode-server/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/organizr/CHANGELOG.md b/charts/stable/organizr/CHANGELOG.md index 64d19de4e7d..61d6d985ffe 100644 --- a/charts/stable/organizr/CHANGELOG.md +++ b/charts/stable/organizr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [organizr-9.0.27](https://github.com/truecharts/apps/compare/organizr-9.0.26...organizr-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [organizr-9.0.26](https://github.com/truecharts/apps/compare/organizr-9.0.25...organizr-9.0.26) (2021-12-19) diff --git a/charts/stable/organizr/README.md b/charts/stable/organizr/README.md index 6bbc3af93e8..c35651271c5 100644 --- a/charts/stable/organizr/README.md +++ b/charts/stable/organizr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/organizr/security.md b/charts/stable/organizr/security.md index 4c26e0e4c25..5d7902f75e2 100644 --- a/charts/stable/organizr/security.md +++ b/charts/stable/organizr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -82,6 +78,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-r0 | 2.4.52-r0 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-r0 | 2.4.52-r0 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| | busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| | busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| diff --git a/charts/stable/oscam/CHANGELOG.md b/charts/stable/oscam/CHANGELOG.md index 14bc2365d84..32b34f447f7 100644 --- a/charts/stable/oscam/CHANGELOG.md +++ b/charts/stable/oscam/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [oscam-4.0.26](https://github.com/truecharts/apps/compare/oscam-4.0.25...oscam-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [oscam-4.0.25](https://github.com/truecharts/apps/compare/oscam-4.0.24...oscam-4.0.25) (2021-12-19) diff --git a/charts/stable/oscam/README.md b/charts/stable/oscam/README.md index 9133c12b77c..23821c6d005 100644 --- a/charts/stable/oscam/README.md +++ b/charts/stable/oscam/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/oscam/security.md b/charts/stable/oscam/security.md index 93b3b5c5bbf..fc038cc48be 100644 --- a/charts/stable/oscam/security.md +++ b/charts/stable/oscam/security.md @@ -20,15 +20,12 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-oscam' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/overseerr/CHANGELOG.md b/charts/stable/overseerr/CHANGELOG.md index 06ed52045f5..a37077aef05 100644 --- a/charts/stable/overseerr/CHANGELOG.md +++ b/charts/stable/overseerr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [overseerr-4.0.26](https://github.com/truecharts/apps/compare/overseerr-4.0.25...overseerr-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [overseerr-4.0.25](https://github.com/truecharts/apps/compare/overseerr-4.0.24...overseerr-4.0.25) (2021-12-19) diff --git a/charts/stable/overseerr/README.md b/charts/stable/overseerr/README.md index 1b8e99da094..92b6aeff8f9 100644 --- a/charts/stable/overseerr/README.md +++ b/charts/stable/overseerr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/overseerr/security.md b/charts/stable/overseerr/security.md index 67ea9b1fa26..be945c20736 100644 --- a/charts/stable/overseerr/security.md +++ b/charts/stable/overseerr/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-overseerr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/owncast/CHANGELOG.md b/charts/stable/owncast/CHANGELOG.md index 15b599c2f06..c47fa8361e0 100644 --- a/charts/stable/owncast/CHANGELOG.md +++ b/charts/stable/owncast/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [owncast-4.0.26](https://github.com/truecharts/apps/compare/owncast-4.0.25...owncast-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [owncast-4.0.25](https://github.com/truecharts/apps/compare/owncast-4.0.24...owncast-4.0.25) (2021-12-19) diff --git a/charts/stable/owncast/README.md b/charts/stable/owncast/README.md index 267dca07d68..911a93edb6e 100644 --- a/charts/stable/owncast/README.md +++ b/charts/stable/owncast/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/owncast/security.md b/charts/stable/owncast/security.md index d661fe8daeb..2f44e22c2f8 100644 --- a/charts/stable/owncast/security.md +++ b/charts/stable/owncast/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/owncloud-ocis/CHANGELOG.md b/charts/stable/owncloud-ocis/CHANGELOG.md index 38c2bf499b0..32b11557825 100644 --- a/charts/stable/owncloud-ocis/CHANGELOG.md +++ b/charts/stable/owncloud-ocis/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [owncloud-ocis-4.0.28](https://github.com/truecharts/apps/compare/owncloud-ocis-4.0.27...owncloud-ocis-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [owncloud-ocis-4.0.27](https://github.com/truecharts/apps/compare/owncloud-ocis-4.0.26...owncloud-ocis-4.0.27) (2021-12-19) diff --git a/charts/stable/owncloud-ocis/README.md b/charts/stable/owncloud-ocis/README.md index ed9f8fcb5c3..af65a24ad21 100644 --- a/charts/stable/owncloud-ocis/README.md +++ b/charts/stable/owncloud-ocis/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/owncloud-ocis/security.md b/charts/stable/owncloud-ocis/security.md index 2faf71db39d..41220af4819 100644 --- a/charts/stable/owncloud-ocis/security.md +++ b/charts/stable/owncloud-ocis/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-owncloud-ocis' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -89,4 +86,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| diff --git a/charts/stable/paperless-ng/CHANGELOG.md b/charts/stable/paperless-ng/CHANGELOG.md index 394e7e592b0..f46f6a6b2d7 100644 --- a/charts/stable/paperless-ng/CHANGELOG.md +++ b/charts/stable/paperless-ng/CHANGELOG.md @@ -1,6 +1,19 @@ # Changelog
+ +### [paperless-ng-1.0.5](https://github.com/truecharts/apps/compare/paperless-ng-1.0.4...paperless-ng-1.0.5) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + +#### Fix + +* fix redis URL and use default paths ([#1560](https://github.com/truecharts/apps/issues/1560)) + + + ### [paperless-ng-1.0.4](https://github.com/truecharts/apps/compare/paperless-ng-1.0.3...paperless-ng-1.0.4) (2021-12-19) diff --git a/charts/stable/paperless-ng/README.md b/charts/stable/paperless-ng/README.md index 582734b90af..d9f4c87398f 100644 --- a/charts/stable/paperless-ng/README.md +++ b/charts/stable/paperless-ng/README.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/paperless-ng/helm-values.md b/charts/stable/paperless-ng/helm-values.md index dbf701293c5..79beda0e76e 100644 --- a/charts/stable/paperless-ng/helm-values.md +++ b/charts/stable/paperless-ng/helm-values.md @@ -12,7 +12,7 @@ You will, however, be able to use all values referenced in the common chart here | Key | Type | Default | Description | |-----|------|---------|-------------| | env.PAPERLESS_CONSUMPTION_DIR | string | `"/consume/"` | | -| env.PAPERLESS_DATA_DIR | string | `"/config/"` | | +| env.PAPERLESS_DATA_DIR | string | `"/data/"` | | | env.PAPERLESS_DBNAME | string | `"{{ .Values.postgresql.postgresqlDatabase }}"` | | | env.PAPERLESS_DBPORT | string | `"5432"` | | | env.PAPERLESS_DBUSER | string | `"{{ .Values.postgresql.postgresqlUsername }}"` | | @@ -20,7 +20,7 @@ You will, however, be able to use all values referenced in the common chart here | env.PAPERLESS_STATICDIR | string | `"/static/"` | | | env.PAPERLESS_TIME_ZONE | string | `"{{ .Values.env.TZ }}"` | | | env.PUID | int | `568` | | -| env.USERMAP_GID | string | `"{{ .Values.env.PGID }}"` | | +| env.USERMAP_GID | string | `"{{ .Values.podSecurityContext.fsGroup }}"` | | | env.USERMAP_UID | string | `"{{ .Values.env.PUID }}"` | | | envValueFrom.PAPERLESS_DBHOST.secretKeyRef.key | string | `"plainhost"` | | | envValueFrom.PAPERLESS_DBHOST.secretKeyRef.name | string | `"dbcreds"` | | @@ -33,10 +33,10 @@ You will, however, be able to use all values referenced in the common chart here | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/paperless-ng"` | | | image.tag | string | `"v1.5.0@sha256:94b00a3fb7e829a6a86d8bfd01abd558d20286976501716b6148a504e6544e3a"` | | -| persistence.config.enabled | bool | `true` | | -| persistence.config.mountPath | string | `"/config"` | | | persistence.consume.enabled | bool | `true` | | | persistence.consume.mountPath | string | `"/consume"` | | +| persistence.data.enabled | bool | `true` | | +| persistence.data.mountPath | string | `"/data"` | | | persistence.media.enabled | bool | `true` | | | persistence.media.mountPath | string | `"/media"` | | | persistence.static.enabled | bool | `true` | | @@ -49,7 +49,7 @@ You will, however, be able to use all values referenced in the common chart here | postgresql.postgresqlUsername | string | `"paperless-ng"` | | | redis.enabled | bool | `true` | | | redis.existingSecret | string | `"rediscreds"` | | -| redis.redisUsername | string | `"paperless-ng"` | | +| redis.redisUsername | string | `"default"` | | | secret.PAPERLESS_ADMIN_MAIL | string | `"admin@admin.com"` | | | secret.PAPERLESS_ADMIN_PASSWORD | string | `"admin"` | | | secret.PAPERLESS_ADMIN_USER | string | `"admin"` | | diff --git a/charts/stable/paperless-ng/security.md b/charts/stable/paperless-ng/security.md index 0919c1f1fb7..4fb7da6f582 100644 --- a/charts/stable/paperless-ng/security.md +++ b/charts/stable/paperless-ng/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,15 +48,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -78,12 +64,12 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/paperless-ng:v1.5.0@sha256:94b00a3fb7e829a6a86d8bfd01abd558d20286976501716b6148a504e6544e3a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -120,7 +106,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -682,7 +668,7 @@ hide: | linux-libc-dev | CVE-2021-40490 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| | linux-libc-dev | CVE-2021-41073 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...http://www.openwall.com/lists/oss-security/2021/09/18/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41073
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J7KSMIOQ4377CVTHMWNGNCWHMCRFRP2T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAP4TXEZ7J4EZQMQW5SIJMWXG7WZT3F7/
https://security.netapp.com/advisory/ntap-20211014-0003/
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://www.debian.org/security/2021/dsa-4978
https://www.openwall.com/lists/oss-security/2021/09/18/2
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-4 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -698,9 +684,9 @@ hide: | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-4 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| | linux-libc-dev | CVE-2020-3702 | MEDIUM | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/linux-wireless/CABvG-CVvPF++0vuGzCrBj8+s=Bcx1GwWfiW1_Somu_GVncTAcQ@mail.gmail.com/
https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#mf8b430d4f19f1b939a29b6c5098fdc514fd1a928
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.arista.com/en/support/advisories-notices/security-advisories/11998-security-advisory-58
https://www.debian.org/security/2021/dsa-4978
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -717,15 +703,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-4 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-4 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-4 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-4 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-4 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -771,7 +759,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-4 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -842,7 +834,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1090,7 +1082,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/papermerge/CHANGELOG.md b/charts/stable/papermerge/CHANGELOG.md index 8c8884392a6..309b1467fe4 100644 --- a/charts/stable/papermerge/CHANGELOG.md +++ b/charts/stable/papermerge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [papermerge-0.0.8](https://github.com/truecharts/apps/compare/papermerge-0.0.7...papermerge-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [papermerge-0.0.7](https://github.com/truecharts/apps/compare/papermerge-0.0.6...papermerge-0.0.7) (2021-12-19) diff --git a/charts/stable/papermerge/README.md b/charts/stable/papermerge/README.md index c7cbb04846f..3976ef3be34 100644 --- a/charts/stable/papermerge/README.md +++ b/charts/stable/papermerge/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/charts/stable/papermerge/security.md b/charts/stable/papermerge/security.md index 1d8868cfa10..872b0951cce 100644 --- a/charts/stable/papermerge/security.md +++ b/charts/stable/papermerge/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/papermerge:v2.0.1 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -307,7 +300,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/charts/stable/pgadmin/CHANGELOG.md b/charts/stable/pgadmin/CHANGELOG.md index f3a52b534c1..8a1d26afed5 100644 --- a/charts/stable/pgadmin/CHANGELOG.md +++ b/charts/stable/pgadmin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pgadmin-5.0.8](https://github.com/truecharts/apps/compare/pgadmin-5.0.7...pgadmin-5.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pgadmin-5.0.7](https://github.com/truecharts/apps/compare/pgadmin-5.0.6...pgadmin-5.0.7) (2021-12-20) diff --git a/charts/stable/pgadmin/README.md b/charts/stable/pgadmin/README.md index ff7586b2f45..b6c74ceed97 100644 --- a/charts/stable/pgadmin/README.md +++ b/charts/stable/pgadmin/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pgadmin/security.md b/charts/stable/pgadmin/security.md index b260b580f67..90d67d581a2 100644 --- a/charts/stable/pgadmin/security.md +++ b/charts/stable/pgadmin/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/photoprism/CHANGELOG.md b/charts/stable/photoprism/CHANGELOG.md index 62a7b992b08..f01097f0d12 100644 --- a/charts/stable/photoprism/CHANGELOG.md +++ b/charts/stable/photoprism/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [photoprism-7.0.9](https://github.com/truecharts/apps/compare/photoprism-7.0.8...photoprism-7.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [photoprism-7.0.8](https://github.com/truecharts/apps/compare/photoprism-7.0.7...photoprism-7.0.8) (2021-12-19) diff --git a/charts/stable/photoprism/README.md b/charts/stable/photoprism/README.md index 19d7dd83e04..cf2d1193444 100644 --- a/charts/stable/photoprism/README.md +++ b/charts/stable/photoprism/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/photoprism/security.md b/charts/stable/photoprism/security.md index 10f3c7bf000..f8aba7dbbc5 100644 --- a/charts/stable/photoprism/security.md +++ b/charts/stable/photoprism/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,16 +32,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-photoprism' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -54,7 +47,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/photoprism:v20211215@sha256:2f98a254657a06f0648f66d3bf14a9d190c5e7fa8b6d25e5970aa854a1d891f0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -276,7 +269,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| **gobinary** @@ -319,7 +312,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/photoshow/CHANGELOG.md b/charts/stable/photoshow/CHANGELOG.md index 19e5be4a598..57e373ac781 100644 --- a/charts/stable/photoshow/CHANGELOG.md +++ b/charts/stable/photoshow/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [photoshow-1.0.30](https://github.com/truecharts/apps/compare/photoshow-1.0.29...photoshow-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [photoshow-1.0.29](https://github.com/truecharts/apps/compare/photoshow-1.0.28...photoshow-1.0.29) (2021-12-19) diff --git a/charts/stable/photoshow/README.md b/charts/stable/photoshow/README.md index 58bdd464706..90ebb32ff15 100644 --- a/charts/stable/photoshow/README.md +++ b/charts/stable/photoshow/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/photoshow/security.md b/charts/stable/photoshow/security.md index 34493901d54..600e8ad242e 100644 --- a/charts/stable/photoshow/security.md +++ b/charts/stable/photoshow/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/phpldapadmin/CHANGELOG.md b/charts/stable/phpldapadmin/CHANGELOG.md index 9223479c1d9..138659ce7c6 100644 --- a/charts/stable/phpldapadmin/CHANGELOG.md +++ b/charts/stable/phpldapadmin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [phpldapadmin-4.0.27](https://github.com/truecharts/apps/compare/phpldapadmin-4.0.26...phpldapadmin-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [phpldapadmin-4.0.26](https://github.com/truecharts/apps/compare/phpldapadmin-4.0.25...phpldapadmin-4.0.26) (2021-12-19) diff --git a/charts/stable/phpldapadmin/README.md b/charts/stable/phpldapadmin/README.md index c5ca76ed8ea..49d3a4ea241 100644 --- a/charts/stable/phpldapadmin/README.md +++ b/charts/stable/phpldapadmin/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/phpldapadmin/security.md b/charts/stable/phpldapadmin/security.md index 07163b8ea84..28f96039a44 100644 --- a/charts/stable/phpldapadmin/security.md +++ b/charts/stable/phpldapadmin/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -98,6 +94,8 @@ hide: | apache2 | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2 | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2 | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -122,6 +120,8 @@ hide: | apache2-bin | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-bin | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-bin | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -146,6 +146,8 @@ hide: | apache2-data | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-data | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-data | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -170,6 +172,8 @@ hide: | apache2-utils | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-utils | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-utils | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| diff --git a/charts/stable/piaware/CHANGELOG.md b/charts/stable/piaware/CHANGELOG.md index d1390aea9fa..d2a26c3865e 100644 --- a/charts/stable/piaware/CHANGELOG.md +++ b/charts/stable/piaware/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [piaware-4.0.31](https://github.com/truecharts/apps/compare/piaware-4.0.30...piaware-4.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [piaware-4.0.30](https://github.com/truecharts/apps/compare/piaware-4.0.29...piaware-4.0.30) (2021-12-20) diff --git a/charts/stable/piaware/README.md b/charts/stable/piaware/README.md index e62604ae9bb..adee750bdd9 100644 --- a/charts/stable/piaware/README.md +++ b/charts/stable/piaware/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/piaware/security.md b/charts/stable/piaware/security.md index b0605ddb170..a8f4630267c 100644 --- a/charts/stable/piaware/security.md +++ b/charts/stable/piaware/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/pidgin/CHANGELOG.md b/charts/stable/pidgin/CHANGELOG.md index c205cb48e7a..a99bfbec7d0 100644 --- a/charts/stable/pidgin/CHANGELOG.md +++ b/charts/stable/pidgin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pidgin-0.0.7](https://github.com/truecharts/apps/compare/pidgin-0.0.6...pidgin-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pidgin-0.0.6](https://github.com/truecharts/apps/compare/pidgin-0.0.5...pidgin-0.0.6) (2021-12-19) diff --git a/charts/stable/pidgin/README.md b/charts/stable/pidgin/README.md index 21a6283929c..8e5399c12d7 100644 --- a/charts/stable/pidgin/README.md +++ b/charts/stable/pidgin/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pidgin/security.md b/charts/stable/pidgin/security.md index 1ed3da7c581..5e335409b1a 100644 --- a/charts/stable/pidgin/security.md +++ b/charts/stable/pidgin/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/pihole/CHANGELOG.md b/charts/stable/pihole/CHANGELOG.md index 9fd14c8b4f9..5af4873f770 100644 --- a/charts/stable/pihole/CHANGELOG.md +++ b/charts/stable/pihole/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pihole-4.0.29](https://github.com/truecharts/apps/compare/pihole-4.0.28...pihole-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pihole-4.0.28](https://github.com/truecharts/apps/compare/pihole-4.0.27...pihole-4.0.28) (2021-12-19) diff --git a/charts/stable/pihole/README.md b/charts/stable/pihole/README.md index c39dcdc4787..826b4373ade 100644 --- a/charts/stable/pihole/README.md +++ b/charts/stable/pihole/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pihole/security.md b/charts/stable/pihole/security.md index 1311df7d9c5..a92b654f582 100644 --- a/charts/stable/pihole/security.md +++ b/charts/stable/pihole/security.md @@ -21,12 +21,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/piwigo/CHANGELOG.md b/charts/stable/piwigo/CHANGELOG.md index 4fbe5e8aeb8..3670fa39454 100644 --- a/charts/stable/piwigo/CHANGELOG.md +++ b/charts/stable/piwigo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [piwigo-1.0.27](https://github.com/truecharts/apps/compare/piwigo-1.0.26...piwigo-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [piwigo-1.0.26](https://github.com/truecharts/apps/compare/piwigo-1.0.25...piwigo-1.0.26) (2021-12-19) diff --git a/charts/stable/piwigo/README.md b/charts/stable/piwigo/README.md index 58e4dbe0ccd..4e99797434c 100644 --- a/charts/stable/piwigo/README.md +++ b/charts/stable/piwigo/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/piwigo/security.md b/charts/stable/piwigo/security.md index df81d2c7458..9ca2ea2d481 100644 --- a/charts/stable/piwigo/security.md +++ b/charts/stable/piwigo/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/pixapop/CHANGELOG.md b/charts/stable/pixapop/CHANGELOG.md index 7eeab0f48d0..5c30f7c7c47 100644 --- a/charts/stable/pixapop/CHANGELOG.md +++ b/charts/stable/pixapop/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pixapop-1.0.26](https://github.com/truecharts/apps/compare/pixapop-1.0.25...pixapop-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pixapop-1.0.25](https://github.com/truecharts/apps/compare/pixapop-1.0.24...pixapop-1.0.25) (2021-12-19) diff --git a/charts/stable/pixapop/README.md b/charts/stable/pixapop/README.md index e0ffbaf8e1c..3f751234c5c 100644 --- a/charts/stable/pixapop/README.md +++ b/charts/stable/pixapop/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pixapop/security.md b/charts/stable/pixapop/security.md index 89f1d7824e9..223a32d0807 100644 --- a/charts/stable/pixapop/security.md +++ b/charts/stable/pixapop/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -142,12 +138,12 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| symfony/cache | CVE-2019-18889 | CRITICAL | v4.2.3 | 4.1.0, 4.2.0, 4.2.12, 4.3.8, 3.2.0, 3.3.0, 3.4.0, 3.4.35 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18889
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml
https://github.com/advisories/GHSA-79gr-58r3-pwm3
https://github.com/symfony/symfony/commit/8817d28fcaacb31fe01d267f6e19b44d8179395a
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://nvd.nist.gov/vuln/detail/CVE-2019-18889
https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18889
| -| symfony/cache | CVE-2019-10912 | HIGH | v4.2.3 | 4.2.7, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 4.1.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
https://github.com/advisories/GHSA-w2fr-65vp-mxw3
https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
https://nvd.nist.gov/vuln/detail/CVE-2019-10912
https://seclists.org/bugtraq/2019/May/21
https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
https://symfony.com/cve-2019-10912
https://typo3.org/security/advisory/typo3-core-sa-2019-016
https://typo3.org/security/advisory/typo3-core-sa-2019-016/
https://www.debian.org/security/2019/dsa-4441
| -| symfony/dependency-injection | CVE-2019-10910 | CRITICAL | v4.2.4 | 3.1.0, 3.2.0, 3.4.0, 4.1.0, 4.1.12, 2.7.51, 3.3.0, 3.4.26, 4.2.7, 2.8.50 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
https://github.com/advisories/GHSA-pgwj-prpq-jpc2
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://nvd.nist.gov/vuln/detail/CVE-2019-10910
https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
https://symfony.com/cve-2019-10910
https://www.drupal.org/SA-CORE-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| -| symfony/framework-bundle | CVE-2019-10909 | MEDIUM | v4.2.3 | 4.1.0, 4.2.7, 3.2.0, 3.4.0, 3.4.26, 3.3.0, 4.1.12, 2.7.51, 2.8.50, 3.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
https://github.com/advisories/GHSA-g996-q5r8-w7g2
https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
https://nvd.nist.gov/vuln/detail/CVE-2019-10909
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
https://symfony.com/cve-2019-10909
https://www.drupal.org/SA-CORE-2019-005
https://www.drupal.org/sa-core-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| -| symfony/http-foundation | CVE-2019-10913 | CRITICAL | v4.2.4 | 3.1.0, 3.2.0, 4.1.12, 4.2.7, 2.7.51, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 2.8.50 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
https://github.com/advisories/GHSA-x92h-wmg2-6hp7
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
https://nvd.nist.gov/vuln/detail/CVE-2019-10913
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
https://symfony.com/cve-2019-10913
| -| symfony/http-foundation | CVE-2019-18888 | HIGH | v4.2.4 | 2.4.0, 2.6.0, 3.2.0, 3.3.0, 4.3.8, 2.3.0, 3.1.0, 3.4.35, 4.2.0, 2.7.0, 2.2.0, 2.5.0, 2.8.52, 3.4.0, 2.1.0, 4.1.0, 4.2.12, 2.8.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18888
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
https://github.com/advisories/GHSA-xhh6-956q-4q69
https://github.com/symfony/symfony/commit/691486e43ce0e4893cd703e221bafc10a871f365
https://github.com/symfony/symfony/commit/77ddabf2e785ea85860d2720cc86f7c5d8967ed5
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://nvd.nist.gov/vuln/detail/CVE-2019-18888
https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18888
| -| symfony/http-kernel | CVE-2019-18887 | HIGH | v4.2.4 | 2.8.0, 3.3.0, 2.3.0, 2.6.0, 4.1.0, 4.2.12, 4.3.8, 2.4.0, 2.5.0, 2.7.0, 2.8.52, 3.1.0, 3.2.0, 3.4.0, 3.4.35, 4.2.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18887
https://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18887
| +| symfony/cache | CVE-2019-18889 | CRITICAL | v4.2.3 | 4.2.0, 4.2.12, 4.3.8, 3.2.0, 3.3.0, 3.4.0, 3.4.35, 4.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18889
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml
https://github.com/advisories/GHSA-79gr-58r3-pwm3
https://github.com/symfony/symfony/commit/8817d28fcaacb31fe01d267f6e19b44d8179395a
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://nvd.nist.gov/vuln/detail/CVE-2019-18889
https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18889
| +| symfony/cache | CVE-2019-10912 | HIGH | v4.2.3 | 4.1.0, 4.1.12, 4.2.7, 3.2.0, 3.3.0, 3.4.0, 3.4.26 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
https://github.com/advisories/GHSA-w2fr-65vp-mxw3
https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
https://nvd.nist.gov/vuln/detail/CVE-2019-10912
https://seclists.org/bugtraq/2019/May/21
https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
https://symfony.com/cve-2019-10912
https://typo3.org/security/advisory/typo3-core-sa-2019-016
https://typo3.org/security/advisory/typo3-core-sa-2019-016/
https://www.debian.org/security/2019/dsa-4441
| +| symfony/dependency-injection | CVE-2019-10910 | CRITICAL | v4.2.4 | 2.8.50, 4.1.0, 4.2.7, 2.7.51, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.12, 3.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
https://github.com/advisories/GHSA-pgwj-prpq-jpc2
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://nvd.nist.gov/vuln/detail/CVE-2019-10910
https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
https://symfony.com/cve-2019-10910
https://www.drupal.org/SA-CORE-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| +| symfony/framework-bundle | CVE-2019-10909 | MEDIUM | v4.2.3 | 3.4.26, 4.1.0, 4.2.7, 2.7.51, 3.1.0, 3.3.0, 4.1.12, 2.8.50, 3.2.0, 3.4.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
https://github.com/advisories/GHSA-g996-q5r8-w7g2
https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
https://nvd.nist.gov/vuln/detail/CVE-2019-10909
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
https://symfony.com/cve-2019-10909
https://www.drupal.org/SA-CORE-2019-005
https://www.drupal.org/sa-core-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| +| symfony/http-foundation | CVE-2019-10913 | CRITICAL | v4.2.4 | 3.1.0, 3.3.0, 3.4.26, 4.1.0, 4.2.7, 2.7.51, 2.8.50, 3.2.0, 3.4.0, 4.1.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
https://github.com/advisories/GHSA-x92h-wmg2-6hp7
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
https://nvd.nist.gov/vuln/detail/CVE-2019-10913
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
https://symfony.com/cve-2019-10913
| +| symfony/http-foundation | CVE-2019-18888 | HIGH | v4.2.4 | 2.5.0, 3.1.0, 4.2.0, 2.3.0, 2.4.0, 3.3.0, 2.8.0, 2.8.52, 3.2.0, 3.4.35, 4.1.0, 2.1.0, 2.2.0, 2.7.0, 4.3.8, 2.6.0, 3.4.0, 4.2.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18888
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
https://github.com/advisories/GHSA-xhh6-956q-4q69
https://github.com/symfony/symfony/commit/691486e43ce0e4893cd703e221bafc10a871f365
https://github.com/symfony/symfony/commit/77ddabf2e785ea85860d2720cc86f7c5d8967ed5
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://nvd.nist.gov/vuln/detail/CVE-2019-18888
https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18888
| +| symfony/http-kernel | CVE-2019-18887 | HIGH | v4.2.4 | 4.2.0, 2.4.0, 2.7.0, 2.8.52, 4.1.0, 2.8.0, 3.3.0, 3.4.35, 4.3.8, 2.6.0, 3.1.0, 3.2.0, 3.4.0, 2.3.0, 2.5.0, 4.2.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18887
https://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18887
| | symfony/var-exporter | CVE-2019-11325 | CRITICAL | v4.2.3 | 4.2.12, 4.3.8 |
Expand...https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-11325.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/var-exporter/CVE-2019-11325.yaml
https://github.com/advisories/GHSA-w4rc-rx25-8m86
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
https://nvd.nist.gov/vuln/detail/CVE-2019-11325
https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-11325
| | twig/twig | CVE-2019-9942 | LOW | v2.6.2 | 1.38.0, 2.7.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9942
https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077
https://seclists.org/bugtraq/2019/Mar/60
https://symfony.com/blog/twig-sandbox-information-disclosure
https://www.debian.org/security/2019/dsa-4419
| diff --git a/charts/stable/plex/CHANGELOG.md b/charts/stable/plex/CHANGELOG.md index 8ad81f24b43..969f5ef73eb 100644 --- a/charts/stable/plex/CHANGELOG.md +++ b/charts/stable/plex/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [plex-8.0.27](https://github.com/truecharts/apps/compare/plex-8.0.26...plex-8.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [plex-8.0.26](https://github.com/truecharts/apps/compare/plex-8.0.25...plex-8.0.26) (2021-12-19) diff --git a/charts/stable/plex/README.md b/charts/stable/plex/README.md index 09f14ec6979..5515fe3afd7 100644 --- a/charts/stable/plex/README.md +++ b/charts/stable/plex/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/plex/security.md b/charts/stable/plex/security.md index 3ec75a11159..e9a7247a850 100644 --- a/charts/stable/plex/security.md +++ b/charts/stable/plex/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-plex' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -164,4 +161,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/podgrab/CHANGELOG.md b/charts/stable/podgrab/CHANGELOG.md index 77ee0f9913a..5ce0bf861ff 100644 --- a/charts/stable/podgrab/CHANGELOG.md +++ b/charts/stable/podgrab/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [podgrab-8.0.7](https://github.com/truecharts/apps/compare/podgrab-8.0.6...podgrab-8.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [podgrab-8.0.6](https://github.com/truecharts/apps/compare/podgrab-8.0.5...podgrab-8.0.6) (2021-12-19) diff --git a/charts/stable/podgrab/README.md b/charts/stable/podgrab/README.md index 12a0e392ec9..bbfa09ce298 100644 --- a/charts/stable/podgrab/README.md +++ b/charts/stable/podgrab/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/podgrab/security.md b/charts/stable/podgrab/security.md index 9d14f04bb69..66a95d64d38 100644 --- a/charts/stable/podgrab/security.md +++ b/charts/stable/podgrab/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-podgrab' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -87,5 +84,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200820211705-5c72a883971a | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/charts/stable/pretend-youre-xyzzy/CHANGELOG.md b/charts/stable/pretend-youre-xyzzy/CHANGELOG.md index 1e2672ed8d1..08bb4354018 100644 --- a/charts/stable/pretend-youre-xyzzy/CHANGELOG.md +++ b/charts/stable/pretend-youre-xyzzy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pretend-youre-xyzzy-4.0.26](https://github.com/truecharts/apps/compare/pretend-youre-xyzzy-4.0.25...pretend-youre-xyzzy-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pretend-youre-xyzzy-4.0.25](https://github.com/truecharts/apps/compare/pretend-youre-xyzzy-4.0.24...pretend-youre-xyzzy-4.0.25) (2021-12-19) diff --git a/charts/stable/pretend-youre-xyzzy/README.md b/charts/stable/pretend-youre-xyzzy/README.md index 1e01a72148f..39ea12e13d0 100644 --- a/charts/stable/pretend-youre-xyzzy/README.md +++ b/charts/stable/pretend-youre-xyzzy/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pretend-youre-xyzzy/security.md b/charts/stable/pretend-youre-xyzzy/security.md index fc81fd3d929..267447de4fc 100644 --- a/charts/stable/pretend-youre-xyzzy/security.md +++ b/charts/stable/pretend-youre-xyzzy/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/projectsend/CHANGELOG.md b/charts/stable/projectsend/CHANGELOG.md index eb186868037..b4abd4962d0 100644 --- a/charts/stable/projectsend/CHANGELOG.md +++ b/charts/stable/projectsend/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [projectsend-0.0.7](https://github.com/truecharts/apps/compare/projectsend-0.0.6...projectsend-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [projectsend-0.0.6](https://github.com/truecharts/apps/compare/projectsend-0.0.5...projectsend-0.0.6) (2021-12-19) diff --git a/charts/stable/projectsend/README.md b/charts/stable/projectsend/README.md index c1981b13737..de3981a9933 100644 --- a/charts/stable/projectsend/README.md +++ b/charts/stable/projectsend/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/projectsend/security.md b/charts/stable/projectsend/security.md index 3bec8243c9a..ae3f013f821 100644 --- a/charts/stable/projectsend/security.md +++ b/charts/stable/projectsend/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/promcord/CHANGELOG.md b/charts/stable/promcord/CHANGELOG.md index db3cf8025d2..2d74a2406de 100644 --- a/charts/stable/promcord/CHANGELOG.md +++ b/charts/stable/promcord/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [promcord-2.0.7](https://github.com/truecharts/apps/compare/promcord-2.0.6...promcord-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [promcord-2.0.6](https://github.com/truecharts/apps/compare/promcord-2.0.5...promcord-2.0.6) (2021-12-19) diff --git a/charts/stable/promcord/README.md b/charts/stable/promcord/README.md index 745c498d287..535d7cb428d 100644 --- a/charts/stable/promcord/README.md +++ b/charts/stable/promcord/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/promcord/security.md b/charts/stable/promcord/security.md index 40a882cb7a6..09fe380ea6b 100644 --- a/charts/stable/promcord/security.md +++ b/charts/stable/promcord/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-promcord' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/protonmail-bridge/CHANGELOG.md b/charts/stable/protonmail-bridge/CHANGELOG.md index 51f329f1dea..2dc59994245 100644 --- a/charts/stable/protonmail-bridge/CHANGELOG.md +++ b/charts/stable/protonmail-bridge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [protonmail-bridge-4.0.26](https://github.com/truecharts/apps/compare/protonmail-bridge-4.0.25...protonmail-bridge-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [protonmail-bridge-4.0.25](https://github.com/truecharts/apps/compare/protonmail-bridge-4.0.24...protonmail-bridge-4.0.25) (2021-12-19) diff --git a/charts/stable/protonmail-bridge/README.md b/charts/stable/protonmail-bridge/README.md index 12c5835dc99..014933e2229 100644 --- a/charts/stable/protonmail-bridge/README.md +++ b/charts/stable/protonmail-bridge/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/protonmail-bridge/security.md b/charts/stable/protonmail-bridge/security.md index dccbae73173..b9e87705324 100644 --- a/charts/stable/protonmail-bridge/security.md +++ b/charts/stable/protonmail-bridge/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -179,13 +175,13 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5-0.20201125200606-c27b9fd57aec | 0.3.7 |
Expand...
| **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5-0.20201125200606-c27b9fd57aec | 0.3.7 |
Expand...
| diff --git a/charts/stable/prowlarr/CHANGELOG.md b/charts/stable/prowlarr/CHANGELOG.md index 11741bfbcfe..52fbe75df3c 100644 --- a/charts/stable/prowlarr/CHANGELOG.md +++ b/charts/stable/prowlarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [prowlarr-4.0.45](https://github.com/truecharts/apps/compare/prowlarr-4.0.44...prowlarr-4.0.45) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [prowlarr-4.0.44](https://github.com/truecharts/apps/compare/prowlarr-4.0.43...prowlarr-4.0.44) (2021-12-19) diff --git a/charts/stable/prowlarr/README.md b/charts/stable/prowlarr/README.md index d6a28daa230..bbeae5d4e31 100644 --- a/charts/stable/prowlarr/README.md +++ b/charts/stable/prowlarr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/prowlarr/helm-values.md b/charts/stable/prowlarr/helm-values.md index 1b9ae0838f9..10ebfc40877 100644 --- a/charts/stable/prowlarr/helm-values.md +++ b/charts/stable/prowlarr/helm-values.md @@ -15,7 +15,7 @@ You will, however, be able to use all values referenced in the common chart here | env.TZ | string | `"UTC"` | Set the container timezone | | image.pullPolicy | string | `"IfNotPresent"` | image pull policy | | image.repository | string | `"tccr.io/truecharts/prowlarr"` | image repository | -| image.tag | string | `"v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b"` | image tag | +| image.tag | string | `"v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb"` | image tag | | ingress.main | object | See values.yaml | Enable and configure ingress settings for the chart under this key. | | persistence | object | See values.yaml | Configure persistence settings for the chart under this key. | | securityContext.readOnlyRootFilesystem | bool | `false` | | diff --git a/charts/stable/prowlarr/security.md b/charts/stable/prowlarr/security.md index 80111db466c..4761e699d32 100644 --- a/charts/stable/prowlarr/security.md +++ b/charts/stable/prowlarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-prowlarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b + tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b (ubuntu 20.04) +#### Container: tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -125,12 +118,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -150,16 +141,16 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/pwndrop/CHANGELOG.md b/charts/stable/pwndrop/CHANGELOG.md index fc3dbdbac92..70a2f8a7e3e 100644 --- a/charts/stable/pwndrop/CHANGELOG.md +++ b/charts/stable/pwndrop/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pwndrop-0.0.7](https://github.com/truecharts/apps/compare/pwndrop-0.0.6...pwndrop-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pwndrop-0.0.6](https://github.com/truecharts/apps/compare/pwndrop-0.0.5...pwndrop-0.0.6) (2021-12-19) diff --git a/charts/stable/pwndrop/README.md b/charts/stable/pwndrop/README.md index 1e16892cd31..f79dc50daed 100644 --- a/charts/stable/pwndrop/README.md +++ b/charts/stable/pwndrop/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pwndrop/security.md b/charts/stable/pwndrop/security.md index 7c2e2258601..526b9144a2e 100644 --- a/charts/stable/pwndrop/security.md +++ b/charts/stable/pwndrop/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -81,6 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/miekg/dns | CVE-2019-19794 | MEDIUM | v1.1.12 | v1.1.25-0.20191211073109-8ebf2e419df7 |
Expand...https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
| +| github.com/miekg/dns | CVE-2019-19794 | MEDIUM | v1.1.12 | 1.1.25-0.20191211073109-8ebf2e419df7 |
Expand...https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200117160349-530e935923ad | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20200117160349-530e935923ad | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| diff --git a/charts/stable/pydio-cells/CHANGELOG.md b/charts/stable/pydio-cells/CHANGELOG.md index 36b3b8e7e68..cbd96e13638 100644 --- a/charts/stable/pydio-cells/CHANGELOG.md +++ b/charts/stable/pydio-cells/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pydio-cells-0.0.8](https://github.com/truecharts/apps/compare/pydio-cells-0.0.7...pydio-cells-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pydio-cells-0.0.7](https://github.com/truecharts/apps/compare/pydio-cells-0.0.6...pydio-cells-0.0.7) (2021-12-19) diff --git a/charts/stable/pydio-cells/README.md b/charts/stable/pydio-cells/README.md index d20caad553d..572307715a2 100644 --- a/charts/stable/pydio-cells/README.md +++ b/charts/stable/pydio-cells/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pydio-cells/security.md b/charts/stable/pydio-cells/security.md index a455c8cd28c..c0f10e3098d 100644 --- a/charts/stable/pydio-cells/security.md +++ b/charts/stable/pydio-cells/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/pyload/CHANGELOG.md b/charts/stable/pyload/CHANGELOG.md index 8c473ec7fa6..01ba7ee929e 100644 --- a/charts/stable/pyload/CHANGELOG.md +++ b/charts/stable/pyload/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pyload-4.0.26](https://github.com/truecharts/apps/compare/pyload-4.0.25...pyload-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pyload-4.0.25](https://github.com/truecharts/apps/compare/pyload-4.0.24...pyload-4.0.25) (2021-12-19) diff --git a/charts/stable/pyload/README.md b/charts/stable/pyload/README.md index eec78273583..f081a6a74ce 100644 --- a/charts/stable/pyload/README.md +++ b/charts/stable/pyload/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pyload/security.md b/charts/stable/pyload/security.md index 7605a2c8fe0..a0d6acbaf06 100644 --- a/charts/stable/pyload/security.md +++ b/charts/stable/pyload/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/pylon/CHANGELOG.md b/charts/stable/pylon/CHANGELOG.md index 9c66c0cd067..83df58e38fa 100644 --- a/charts/stable/pylon/CHANGELOG.md +++ b/charts/stable/pylon/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pylon-0.0.7](https://github.com/truecharts/apps/compare/pylon-0.0.6...pylon-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pylon-0.0.6](https://github.com/truecharts/apps/compare/pylon-0.0.5...pylon-0.0.6) (2021-12-19) diff --git a/charts/stable/pylon/README.md b/charts/stable/pylon/README.md index 86c80508d71..c91d6ba6f34 100644 --- a/charts/stable/pylon/README.md +++ b/charts/stable/pylon/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/pylon/security.md b/charts/stable/pylon/security.md index f423e6e97fe..62319dc9379 100644 --- a/charts/stable/pylon/security.md +++ b/charts/stable/pylon/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/qbittorrent/CHANGELOG.md b/charts/stable/qbittorrent/CHANGELOG.md index d91ec59d6c1..74dfacf502e 100644 --- a/charts/stable/qbittorrent/CHANGELOG.md +++ b/charts/stable/qbittorrent/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [qbittorrent-9.0.29](https://github.com/truecharts/apps/compare/qbittorrent-9.0.28...qbittorrent-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [qbittorrent-9.0.28](https://github.com/truecharts/apps/compare/qbittorrent-9.0.27...qbittorrent-9.0.28) (2021-12-19) diff --git a/charts/stable/qbittorrent/README.md b/charts/stable/qbittorrent/README.md index f30a5de0b4d..a5a2b0f1f50 100644 --- a/charts/stable/qbittorrent/README.md +++ b/charts/stable/qbittorrent/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/qbittorrent/helm-values.md b/charts/stable/qbittorrent/helm-values.md index 11806a8a4ec..1cd39861aeb 100644 --- a/charts/stable/qbittorrent/helm-values.md +++ b/charts/stable/qbittorrent/helm-values.md @@ -18,7 +18,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/qbittorrent"` | | -| image.tag | string | `"v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c"` | | +| image.tag | string | `"v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | securityContext.readOnlyRootFilesystem | bool | `false` | | diff --git a/charts/stable/qbittorrent/security.md b/charts/stable/qbittorrent/security.md index 72f6785ddef..696f4ca0685 100644 --- a/charts/stable/qbittorrent/security.md +++ b/charts/stable/qbittorrent/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-qbittorrent' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/qbittorrent:v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c + tccr.io/truecharts/qbittorrent:v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/qbittorrent:v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c (ubuntu 20.04) +#### Container: tccr.io/truecharts/qbittorrent:v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -116,7 +109,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -128,12 +120,10 @@ hide: | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libperl5.30 | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libqt5core5a | CVE-2020-13962 | MEDIUM | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html
https://bugreports.qt.io/browse/QTBUG-83450
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13962
https://github.com/mumble-voip/mumble/issues/3679
https://github.com/mumble-voip/mumble/pull/4032
https://linux.oracle.com/cve/CVE-2020-13962.html
https://linux.oracle.com/errata/ELSA-2020-4690.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
https://security.gentoo.org/glsa/202007-18
| | libqt5core5a | CVE-2020-17507 | LOW | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00104.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00105.html
https://codereview.qt-project.org/c/qt/qtbase/+/308436
https://codereview.qt-project.org/c/qt/qtbase/+/308495
https://codereview.qt-project.org/c/qt/qtbase/+/308496
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17507
https://linux.oracle.com/cve/CVE-2020-17507.html
https://linux.oracle.com/errata/ELSA-2021-1756.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00024.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBPZVZNEYXGATTXM4WOE7OQ55VAKPVD6/
https://security.gentoo.org/glsa/202009-04
https://ubuntu.com/security/notices/USN-5081-1
| | libqt5dbus5 | CVE-2020-13962 | MEDIUM | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html
https://bugreports.qt.io/browse/QTBUG-83450
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13962
https://github.com/mumble-voip/mumble/issues/3679
https://github.com/mumble-voip/mumble/pull/4032
https://linux.oracle.com/cve/CVE-2020-13962.html
https://linux.oracle.com/errata/ELSA-2020-4690.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
https://security.gentoo.org/glsa/202007-18
| @@ -163,12 +153,10 @@ hide: | perl | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| | perl-modules-5.30 | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| **gobinary** @@ -176,4 +164,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/quassel-core/CHANGELOG.md b/charts/stable/quassel-core/CHANGELOG.md index 5820357ccae..7b247aa11bf 100644 --- a/charts/stable/quassel-core/CHANGELOG.md +++ b/charts/stable/quassel-core/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [quassel-core-0.0.8](https://github.com/truecharts/apps/compare/quassel-core-0.0.7...quassel-core-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [quassel-core-0.0.7](https://github.com/truecharts/apps/compare/quassel-core-0.0.6...quassel-core-0.0.7) (2021-12-19) diff --git a/charts/stable/quassel-core/README.md b/charts/stable/quassel-core/README.md index cfe945e17aa..93ff94b2a6b 100644 --- a/charts/stable/quassel-core/README.md +++ b/charts/stable/quassel-core/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/quassel-core/security.md b/charts/stable/quassel-core/security.md index dc87e3a66eb..2f0d606f7bc 100644 --- a/charts/stable/quassel-core/security.md +++ b/charts/stable/quassel-core/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,14 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -60,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/quassel-core:v0.13.1 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -100,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -354,7 +345,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/quassel-web/CHANGELOG.md b/charts/stable/quassel-web/CHANGELOG.md index 2d9aaee04c7..3671e653d49 100644 --- a/charts/stable/quassel-web/CHANGELOG.md +++ b/charts/stable/quassel-web/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [quassel-web-0.0.7](https://github.com/truecharts/apps/compare/quassel-web-0.0.6...quassel-web-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [quassel-web-0.0.6](https://github.com/truecharts/apps/compare/quassel-web-0.0.5...quassel-web-0.0.6) (2021-12-19) diff --git a/charts/stable/quassel-web/README.md b/charts/stable/quassel-web/README.md index da77fd68ebf..0b5e1005c19 100644 --- a/charts/stable/quassel-web/README.md +++ b/charts/stable/quassel-web/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/quassel-web/security.md b/charts/stable/quassel-web/security.md index 320ff5c23b9..2eb39353ca3 100644 --- a/charts/stable/quassel-web/security.md +++ b/charts/stable/quassel-web/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/radarr/CHANGELOG.md b/charts/stable/radarr/CHANGELOG.md index f3a3343eb3a..685334c3b12 100644 --- a/charts/stable/radarr/CHANGELOG.md +++ b/charts/stable/radarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [radarr-9.0.27](https://github.com/truecharts/apps/compare/radarr-9.0.26...radarr-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [radarr-9.0.26](https://github.com/truecharts/apps/compare/radarr-9.0.25...radarr-9.0.26) (2021-12-19) diff --git a/charts/stable/radarr/README.md b/charts/stable/radarr/README.md index 2944e7e6fc8..609b0bcbe87 100644 --- a/charts/stable/radarr/README.md +++ b/charts/stable/radarr/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/radarr/helm-values.md b/charts/stable/radarr/helm-values.md index 9f9d6c4394d..cc8fe713f7b 100644 --- a/charts/stable/radarr/helm-values.md +++ b/charts/stable/radarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/radarr"` | | -| image.tag | string | `"v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658"` | | +| image.tag | string | `"v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/charts/stable/radarr/security.md b/charts/stable/radarr/security.md index 4e3fb97f8f6..b340ac253ae 100644 --- a/charts/stable/radarr/security.md +++ b/charts/stable/radarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-radarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/radarr:v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658 + tccr.io/truecharts/radarr:v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/radarr:v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658 (ubuntu 20.04) +#### Container: tccr.io/truecharts/radarr:v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -125,12 +118,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -150,16 +141,16 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/readarr/CHANGELOG.md b/charts/stable/readarr/CHANGELOG.md index 0cfbc03b0d3..197e4bac364 100644 --- a/charts/stable/readarr/CHANGELOG.md +++ b/charts/stable/readarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [readarr-9.0.41](https://github.com/truecharts/apps/compare/readarr-9.0.40...readarr-9.0.41) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [readarr-9.0.40](https://github.com/truecharts/apps/compare/readarr-9.0.39...readarr-9.0.40) (2021-12-20) diff --git a/charts/stable/readarr/README.md b/charts/stable/readarr/README.md index cc2563431a9..9bd49ca8776 100644 --- a/charts/stable/readarr/README.md +++ b/charts/stable/readarr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/readarr/helm-values.md b/charts/stable/readarr/helm-values.md index 0a8b1c1ffc4..fbaec45b721 100644 --- a/charts/stable/readarr/helm-values.md +++ b/charts/stable/readarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/readarr"` | | -| image.tag | string | `"v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f"` | | +| image.tag | string | `"v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/charts/stable/readarr/security.md b/charts/stable/readarr/security.md index d7498966ab4..1b9d3fa1d76 100644 --- a/charts/stable/readarr/security.md +++ b/charts/stable/readarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-readarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/readarr:v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f + tccr.io/truecharts/readarr:v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/readarr:v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f (ubuntu 20.04) +#### Container: tccr.io/truecharts/readarr:v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008 (ubuntu 20.04) **ubuntu** @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/recipes/CHANGELOG.md b/charts/stable/recipes/CHANGELOG.md index ef5382fe446..d1925c23c9c 100644 --- a/charts/stable/recipes/CHANGELOG.md +++ b/charts/stable/recipes/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [recipes-5.0.4](https://github.com/truecharts/apps/compare/recipes-5.0.3...recipes-5.0.4) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [recipes-5.0.3](https://github.com/truecharts/apps/compare/recipes-5.0.2...recipes-5.0.3) (2021-12-20) diff --git a/charts/stable/recipes/README.md b/charts/stable/recipes/README.md index 933342338a2..c10ed06d508 100644 --- a/charts/stable/recipes/README.md +++ b/charts/stable/recipes/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/recipes/security.md b/charts/stable/recipes/security.md index 4181c0b8548..570a1353d61 100644 --- a/charts/stable/recipes/security.md +++ b/charts/stable/recipes/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/recipes:v1.0.3@sha256:293f8d08b8326899e9ce0f4c4c8ffac521c22f168290ddfa0db1da0b81bda296 - 'tccr.io/truecharts/nginx:v1.21.4@sha256:81b9486bd8b0f8c9d933013a4b4a6267463625e0dcc756c01ec766ba386f6c93' tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -423,7 +411,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/reg/CHANGELOG.md b/charts/stable/reg/CHANGELOG.md index b70b3956b67..92d0b87ddcd 100644 --- a/charts/stable/reg/CHANGELOG.md +++ b/charts/stable/reg/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [reg-4.0.25](https://github.com/truecharts/apps/compare/reg-4.0.24...reg-4.0.25) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [reg-4.0.24](https://github.com/truecharts/apps/compare/reg-4.0.23...reg-4.0.24) (2021-12-19) diff --git a/charts/stable/reg/README.md b/charts/stable/reg/README.md index 64925fdc161..564db01e565 100644 --- a/charts/stable/reg/README.md +++ b/charts/stable/reg/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/reg/security.md b/charts/stable/reg/security.md index f1e8de75147..7362e2f44d7 100644 --- a/charts/stable/reg/security.md +++ b/charts/stable/reg/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-reg' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/remmina/CHANGELOG.md b/charts/stable/remmina/CHANGELOG.md index c28703b4473..d53cc31d128 100644 --- a/charts/stable/remmina/CHANGELOG.md +++ b/charts/stable/remmina/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [remmina-1.0.30](https://github.com/truecharts/apps/compare/remmina-1.0.29...remmina-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [remmina-1.0.29](https://github.com/truecharts/apps/compare/remmina-1.0.28...remmina-1.0.29) (2021-12-19) diff --git a/charts/stable/remmina/README.md b/charts/stable/remmina/README.md index 108934ee1e4..d39a00d2d04 100644 --- a/charts/stable/remmina/README.md +++ b/charts/stable/remmina/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/remmina/security.md b/charts/stable/remmina/security.md index 825588a1515..711553f2022 100644 --- a/charts/stable/remmina/security.md +++ b/charts/stable/remmina/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -331,3 +327,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/requestrr/CHANGELOG.md b/charts/stable/requestrr/CHANGELOG.md index 9867119ddf5..825400d3162 100644 --- a/charts/stable/requestrr/CHANGELOG.md +++ b/charts/stable/requestrr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [requestrr-0.0.7](https://github.com/truecharts/apps/compare/requestrr-0.0.6...requestrr-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [requestrr-0.0.6](https://github.com/truecharts/apps/compare/requestrr-0.0.5...requestrr-0.0.6) (2021-12-19) diff --git a/charts/stable/requestrr/README.md b/charts/stable/requestrr/README.md index c615b4c3a10..14e8ec28be1 100644 --- a/charts/stable/requestrr/README.md +++ b/charts/stable/requestrr/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/requestrr/security.md b/charts/stable/requestrr/security.md index cdd7c198331..18c96551c78 100644 --- a/charts/stable/requestrr/security.md +++ b/charts/stable/requestrr/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/resilio-sync/CHANGELOG.md b/charts/stable/resilio-sync/CHANGELOG.md index 3802a25a9e9..cc5091c875b 100644 --- a/charts/stable/resilio-sync/CHANGELOG.md +++ b/charts/stable/resilio-sync/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [resilio-sync-4.0.27](https://github.com/truecharts/apps/compare/resilio-sync-4.0.26...resilio-sync-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [resilio-sync-4.0.26](https://github.com/truecharts/apps/compare/resilio-sync-4.0.25...resilio-sync-4.0.26) (2021-12-21) diff --git a/charts/stable/resilio-sync/README.md b/charts/stable/resilio-sync/README.md index 0e7ed188cde..e3c2e2f4316 100644 --- a/charts/stable/resilio-sync/README.md +++ b/charts/stable/resilio-sync/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/rsnapshot/CHANGELOG.md b/charts/stable/rsnapshot/CHANGELOG.md index ffe0a89ab5f..bd916d61f09 100644 --- a/charts/stable/rsnapshot/CHANGELOG.md +++ b/charts/stable/rsnapshot/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [rsnapshot-0.0.7](https://github.com/truecharts/apps/compare/rsnapshot-0.0.6...rsnapshot-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [rsnapshot-0.0.6](https://github.com/truecharts/apps/compare/rsnapshot-0.0.5...rsnapshot-0.0.6) (2021-12-19) diff --git a/charts/stable/rsnapshot/README.md b/charts/stable/rsnapshot/README.md index 0523e1f46f4..173221cc6fa 100644 --- a/charts/stable/rsnapshot/README.md +++ b/charts/stable/rsnapshot/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/rsnapshot/security.md b/charts/stable/rsnapshot/security.md index 6b606d7d894..5d1e60647e4 100644 --- a/charts/stable/rsnapshot/security.md +++ b/charts/stable/rsnapshot/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/sabnzbd/CHANGELOG.md b/charts/stable/sabnzbd/CHANGELOG.md index a92e668d6eb..4634afab622 100644 --- a/charts/stable/sabnzbd/CHANGELOG.md +++ b/charts/stable/sabnzbd/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [sabnzbd-9.0.26](https://github.com/truecharts/apps/compare/sabnzbd-9.0.25...sabnzbd-9.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [sabnzbd-9.0.25](https://github.com/truecharts/apps/compare/sabnzbd-9.0.24...sabnzbd-9.0.25) (2021-12-19) diff --git a/charts/stable/sabnzbd/README.md b/charts/stable/sabnzbd/README.md index 89280013a2b..db13b20a72c 100644 --- a/charts/stable/sabnzbd/README.md +++ b/charts/stable/sabnzbd/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/sabnzbd/helm-values.md b/charts/stable/sabnzbd/helm-values.md index 1f3fcbac836..8286fef015d 100644 --- a/charts/stable/sabnzbd/helm-values.md +++ b/charts/stable/sabnzbd/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/sabnzbd"` | | -| image.tag | string | `"v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d"` | | +| image.tag | string | `"v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | service.main.ports.main.port | int | `10097` | | diff --git a/charts/stable/sabnzbd/security.md b/charts/stable/sabnzbd/security.md index 58604b84593..2008d046489 100644 --- a/charts/stable/sabnzbd/security.md +++ b/charts/stable/sabnzbd/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-sabnzbd' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/sabnzbd:v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d + tccr.io/truecharts/sabnzbd:v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/sabnzbd:v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d (ubuntu 20.04) +#### Container: tccr.io/truecharts/sabnzbd:v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -125,10 +117,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -148,10 +140,10 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| **python-pkg** @@ -167,4 +159,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/scrutiny/CHANGELOG.md b/charts/stable/scrutiny/CHANGELOG.md index c4069a182e4..ac146780eab 100644 --- a/charts/stable/scrutiny/CHANGELOG.md +++ b/charts/stable/scrutiny/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [scrutiny-0.0.8](https://github.com/truecharts/apps/compare/scrutiny-0.0.7...scrutiny-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [scrutiny-0.0.7](https://github.com/truecharts/apps/compare/scrutiny-0.0.6...scrutiny-0.0.7) (2021-12-19) diff --git a/charts/stable/scrutiny/README.md b/charts/stable/scrutiny/README.md index ff18f0bc05b..0b734557a0e 100644 --- a/charts/stable/scrutiny/README.md +++ b/charts/stable/scrutiny/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/scrutiny/security.md b/charts/stable/scrutiny/security.md index 618c6500998..4034b9c854e 100644 --- a/charts/stable/scrutiny/security.md +++ b/charts/stable/scrutiny/security.md @@ -21,12 +21,9 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV017 | Privileged container | HIGH |
Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.privileged' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv017
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -85,6 +82,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -92,6 +90,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -99,3 +98,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/charts/stable/ser2sock/CHANGELOG.md b/charts/stable/ser2sock/CHANGELOG.md index 1a0db237e0f..b2a3ae5456f 100644 --- a/charts/stable/ser2sock/CHANGELOG.md +++ b/charts/stable/ser2sock/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ser2sock-4.0.26](https://github.com/truecharts/apps/compare/ser2sock-4.0.25...ser2sock-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ser2sock-4.0.25](https://github.com/truecharts/apps/compare/ser2sock-4.0.24...ser2sock-4.0.25) (2021-12-19) diff --git a/charts/stable/ser2sock/README.md b/charts/stable/ser2sock/README.md index d5296268e17..a045a4a5a85 100644 --- a/charts/stable/ser2sock/README.md +++ b/charts/stable/ser2sock/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/shiori/CHANGELOG.md b/charts/stable/shiori/CHANGELOG.md index f56b0e529ae..d7138d84c4a 100644 --- a/charts/stable/shiori/CHANGELOG.md +++ b/charts/stable/shiori/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [shiori-4.0.17](https://github.com/truecharts/apps/compare/shiori-4.0.16...shiori-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [shiori-4.0.16](https://github.com/truecharts/apps/compare/shiori-4.0.15...shiori-4.0.16) (2021-12-19) diff --git a/charts/stable/shiori/README.md b/charts/stable/shiori/README.md index 8c567f8d783..d9d36d277bc 100644 --- a/charts/stable/shiori/README.md +++ b/charts/stable/shiori/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/shiori/security.md b/charts/stable/shiori/security.md index 2028c08dc88..55f43375355 100644 --- a/charts/stable/shiori/security.md +++ b/charts/stable/shiori/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,14 +36,8 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/shiori:version-v1.5.0@sha256:6c6331888c9a5162def49b6212327242f7f5c96e2d5a1bb031f79321cc1c0549 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -326,7 +316,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20190701094942-4def268fd1a4 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20190701094942-4def268fd1a4 | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -361,7 +350,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/shorturl/CHANGELOG.md b/charts/stable/shorturl/CHANGELOG.md index 2dbdd6fced5..72b163acfc6 100644 --- a/charts/stable/shorturl/CHANGELOG.md +++ b/charts/stable/shorturl/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [shorturl-1.0.26](https://github.com/truecharts/apps/compare/shorturl-1.0.25...shorturl-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [shorturl-1.0.25](https://github.com/truecharts/apps/compare/shorturl-1.0.24...shorturl-1.0.25) (2021-12-19) diff --git a/charts/stable/shorturl/README.md b/charts/stable/shorturl/README.md index 6a1cdbd25df..ef493a90947 100644 --- a/charts/stable/shorturl/README.md +++ b/charts/stable/shorturl/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/shorturl/security.md b/charts/stable/shorturl/security.md index 6779081007f..93d05d3b7b4 100644 --- a/charts/stable/shorturl/security.md +++ b/charts/stable/shorturl/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/sickchill/CHANGELOG.md b/charts/stable/sickchill/CHANGELOG.md index aa3dadcb013..b4fa7c79a3e 100644 --- a/charts/stable/sickchill/CHANGELOG.md +++ b/charts/stable/sickchill/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sickchill-1.0.26](https://github.com/truecharts/apps/compare/sickchill-1.0.25...sickchill-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sickchill-1.0.25](https://github.com/truecharts/apps/compare/sickchill-1.0.24...sickchill-1.0.25) (2021-12-19) diff --git a/charts/stable/sickchill/README.md b/charts/stable/sickchill/README.md index ceff8c50883..a7136e89a8c 100644 --- a/charts/stable/sickchill/README.md +++ b/charts/stable/sickchill/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/sickchill/security.md b/charts/stable/sickchill/security.md index a8210c3f828..ee88dcde250 100644 --- a/charts/stable/sickchill/security.md +++ b/charts/stable/sickchill/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/sickgear/CHANGELOG.md b/charts/stable/sickgear/CHANGELOG.md index c83a090f5b8..b9c6a18096d 100644 --- a/charts/stable/sickgear/CHANGELOG.md +++ b/charts/stable/sickgear/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sickgear-1.0.26](https://github.com/truecharts/apps/compare/sickgear-1.0.25...sickgear-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sickgear-1.0.25](https://github.com/truecharts/apps/compare/sickgear-1.0.24...sickgear-1.0.25) (2021-12-19) diff --git a/charts/stable/sickgear/README.md b/charts/stable/sickgear/README.md index a9f492fbe13..18a8c11e4d6 100644 --- a/charts/stable/sickgear/README.md +++ b/charts/stable/sickgear/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/sickgear/security.md b/charts/stable/sickgear/security.md index 99371ce184f..dae9ca8a688 100644 --- a/charts/stable/sickgear/security.md +++ b/charts/stable/sickgear/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/smokeping/CHANGELOG.md b/charts/stable/smokeping/CHANGELOG.md index b8ce4f50d9b..801ff4eed14 100644 --- a/charts/stable/smokeping/CHANGELOG.md +++ b/charts/stable/smokeping/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [smokeping-1.0.28](https://github.com/truecharts/apps/compare/smokeping-1.0.27...smokeping-1.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [smokeping-1.0.27](https://github.com/truecharts/apps/compare/smokeping-1.0.26...smokeping-1.0.27) (2021-12-19) diff --git a/charts/stable/smokeping/README.md b/charts/stable/smokeping/README.md index 9eff26ae500..257c26fd259 100644 --- a/charts/stable/smokeping/README.md +++ b/charts/stable/smokeping/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/smokeping/security.md b/charts/stable/smokeping/security.md index 16869f2f7f1..5e9c39bed9d 100644 --- a/charts/stable/smokeping/security.md +++ b/charts/stable/smokeping/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/snipe-it/CHANGELOG.md b/charts/stable/snipe-it/CHANGELOG.md index ba4235474ca..499162fe50c 100644 --- a/charts/stable/snipe-it/CHANGELOG.md +++ b/charts/stable/snipe-it/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [snipe-it-0.0.18](https://github.com/truecharts/apps/compare/snipe-it-0.0.17...snipe-it-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [snipe-it-0.0.17](https://github.com/truecharts/apps/compare/snipe-it-0.0.16...snipe-it-0.0.17) (2021-12-19) diff --git a/charts/stable/snipe-it/README.md b/charts/stable/snipe-it/README.md index fad5bce5df6..784dbe48d49 100644 --- a/charts/stable/snipe-it/README.md +++ b/charts/stable/snipe-it/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/snipe-it/security.md b/charts/stable/snipe-it/security.md index 1c0b484a6c7..e3823e982d0 100644 --- a/charts/stable/snipe-it/security.md +++ b/charts/stable/snipe-it/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/snipe-it:v5.3.6@sha256:0d7df03b82dc909ba058e33153a307f3639741bef93616e59d3dd8ea4a413d45 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,8 +93,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v6.20.29 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| -| lcobucci/jwt | CVE-2021-41106 | LOW | 3.4.5 | 4.1.5, 3.4.6, 4.0.4 |
Expand...https://github.com/advisories/GHSA-7322-jrq4-x5hf
https://github.com/lcobucci/jwt/commit/8175de5b841fbe3fd97d2d49b3fc15c4ecb39a73
https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c
https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf
https://nvd.nist.gov/vuln/detail/CVE-2021-41106
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v6.20.29 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| lcobucci/jwt | CVE-2021-41106 | LOW | 3.4.5 | 3.4.6, 4.0.4, 4.1.5 |
Expand...https://github.com/advisories/GHSA-7322-jrq4-x5hf
https://github.com/lcobucci/jwt/commit/8175de5b841fbe3fd97d2d49b3fc15c4ecb39a73
https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c
https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf
https://nvd.nist.gov/vuln/detail/CVE-2021-41106
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -137,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/sonarr/CHANGELOG.md b/charts/stable/sonarr/CHANGELOG.md index 9fe89928e3f..291966c5250 100644 --- a/charts/stable/sonarr/CHANGELOG.md +++ b/charts/stable/sonarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [sonarr-9.0.28](https://github.com/truecharts/apps/compare/sonarr-9.0.27...sonarr-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [sonarr-9.0.27](https://github.com/truecharts/apps/compare/sonarr-9.0.26...sonarr-9.0.27) (2021-12-20) diff --git a/charts/stable/sonarr/README.md b/charts/stable/sonarr/README.md index 0cf79c6f661..5d9777b1dfa 100644 --- a/charts/stable/sonarr/README.md +++ b/charts/stable/sonarr/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/sonarr/helm-values.md b/charts/stable/sonarr/helm-values.md index aa0f783ab9a..962506e047d 100644 --- a/charts/stable/sonarr/helm-values.md +++ b/charts/stable/sonarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/sonarr"` | | -| image.tag | string | `"v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a"` | | +| image.tag | string | `"v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/charts/stable/sonarr/security.md b/charts/stable/sonarr/security.md index 25cd55ffa69..de50c5fb2c0 100644 --- a/charts/stable/sonarr/security.md +++ b/charts/stable/sonarr/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-sonarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a + tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a (ubuntu 20.04) +#### Container: tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e (ubuntu 20.04) **ubuntu** @@ -183,4 +180,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/speedtest-exporter/CHANGELOG.md b/charts/stable/speedtest-exporter/CHANGELOG.md index 788b5d5f890..673031c9f78 100644 --- a/charts/stable/speedtest-exporter/CHANGELOG.md +++ b/charts/stable/speedtest-exporter/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [speedtest-exporter-1.0.13](https://github.com/truecharts/apps/compare/speedtest-exporter-1.0.12...speedtest-exporter-1.0.13) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [speedtest-exporter-1.0.12](https://github.com/truecharts/apps/compare/speedtest-exporter-1.0.11...speedtest-exporter-1.0.12) (2021-12-19) diff --git a/charts/stable/speedtest-exporter/README.md b/charts/stable/speedtest-exporter/README.md index a33053b21c9..6b09961b731 100644 --- a/charts/stable/speedtest-exporter/README.md +++ b/charts/stable/speedtest-exporter/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/speedtest-exporter/security.md b/charts/stable/speedtest-exporter/security.md index 03f5cd9fd28..c9e6c437e4a 100644 --- a/charts/stable/speedtest-exporter/security.md +++ b/charts/stable/speedtest-exporter/security.md @@ -19,15 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-speedtest-exporter' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/sqlitebrowser/CHANGELOG.md b/charts/stable/sqlitebrowser/CHANGELOG.md index ece7d7df8b6..6f5399f9d47 100644 --- a/charts/stable/sqlitebrowser/CHANGELOG.md +++ b/charts/stable/sqlitebrowser/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sqlitebrowser-1.0.30](https://github.com/truecharts/apps/compare/sqlitebrowser-1.0.29...sqlitebrowser-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sqlitebrowser-1.0.29](https://github.com/truecharts/apps/compare/sqlitebrowser-1.0.28...sqlitebrowser-1.0.29) (2021-12-19) diff --git a/charts/stable/sqlitebrowser/README.md b/charts/stable/sqlitebrowser/README.md index 7f5ce1ebbec..379f84d43c8 100644 --- a/charts/stable/sqlitebrowser/README.md +++ b/charts/stable/sqlitebrowser/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/sqlitebrowser/security.md b/charts/stable/sqlitebrowser/security.md index 5cad81e6f8a..b1a1455a5e4 100644 --- a/charts/stable/sqlitebrowser/security.md +++ b/charts/stable/sqlitebrowser/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -314,3 +310,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/stash/CHANGELOG.md b/charts/stable/stash/CHANGELOG.md index 52e30ec44a4..93bcec95310 100644 --- a/charts/stable/stash/CHANGELOG.md +++ b/charts/stable/stash/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [stash-5.0.7](https://github.com/truecharts/apps/compare/stash-5.0.6...stash-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [stash-5.0.6](https://github.com/truecharts/apps/compare/stash-5.0.5...stash-5.0.6) (2021-12-19) diff --git a/charts/stable/stash/README.md b/charts/stable/stash/README.md index 23f5a123072..0c1e8485190 100644 --- a/charts/stable/stash/README.md +++ b/charts/stable/stash/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/stash/security.md b/charts/stable/stash/security.md index d034525b0e7..490453cb891 100644 --- a/charts/stable/stash/security.md +++ b/charts/stable/stash/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -95,5 +91,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/charts/stable/static/CHANGELOG.md b/charts/stable/static/CHANGELOG.md index 9b69d2ca4d4..5c1e775dfa1 100644 --- a/charts/stable/static/CHANGELOG.md +++ b/charts/stable/static/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [static-1.0.26](https://github.com/truecharts/apps/compare/static-1.0.25...static-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [static-1.0.25](https://github.com/truecharts/apps/compare/static-1.0.24...static-1.0.25) (2021-12-19) diff --git a/charts/stable/static/README.md b/charts/stable/static/README.md index 3c63b153137..c3dd0271756 100644 --- a/charts/stable/static/README.md +++ b/charts/stable/static/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/static/security.md b/charts/stable/static/security.md index e0fe5229fd9..7b744a62e78 100644 --- a/charts/stable/static/security.md +++ b/charts/stable/static/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/statping/CHANGELOG.md b/charts/stable/statping/CHANGELOG.md index f93d558a48c..91728b26689 100644 --- a/charts/stable/statping/CHANGELOG.md +++ b/charts/stable/statping/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [statping-4.0.17](https://github.com/truecharts/apps/compare/statping-4.0.16...statping-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [statping-4.0.16](https://github.com/truecharts/apps/compare/statping-4.0.15...statping-4.0.16) (2021-12-19) diff --git a/charts/stable/statping/README.md b/charts/stable/statping/README.md index b57f27770ec..efdb600f9c9 100644 --- a/charts/stable/statping/README.md +++ b/charts/stable/statping/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/statping/security.md b/charts/stable/statping/security.md index 4545a37875e..3ea55d494d3 100644 --- a/charts/stable/statping/security.md +++ b/charts/stable/statping/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-statping' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/statping:v0.90.74@sha256:1c7e6cf35253668dd55ab20dde3c3e10d2fefd31416963b81d63846b672f38ce tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -392,6 +383,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -426,7 +418,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/synclounge/CHANGELOG.md b/charts/stable/synclounge/CHANGELOG.md index e7b2fe6d558..c83dfa8d4a2 100644 --- a/charts/stable/synclounge/CHANGELOG.md +++ b/charts/stable/synclounge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [synclounge-0.0.7](https://github.com/truecharts/apps/compare/synclounge-0.0.6...synclounge-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [synclounge-0.0.6](https://github.com/truecharts/apps/compare/synclounge-0.0.5...synclounge-0.0.6) (2021-12-19) diff --git a/charts/stable/synclounge/README.md b/charts/stable/synclounge/README.md index 5e17cd87046..6a59a24801b 100644 --- a/charts/stable/synclounge/README.md +++ b/charts/stable/synclounge/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/synclounge/security.md b/charts/stable/synclounge/security.md index 0588f24c426..91e59c8f596 100644 --- a/charts/stable/synclounge/security.md +++ b/charts/stable/synclounge/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/syncthing/CHANGELOG.md b/charts/stable/syncthing/CHANGELOG.md index 6f0e786da9d..3c71595871d 100644 --- a/charts/stable/syncthing/CHANGELOG.md +++ b/charts/stable/syncthing/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [syncthing-9.0.28](https://github.com/truecharts/apps/compare/syncthing-9.0.27...syncthing-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [syncthing-9.0.27](https://github.com/truecharts/apps/compare/syncthing-9.0.26...syncthing-9.0.27) (2021-12-19) diff --git a/charts/stable/syncthing/README.md b/charts/stable/syncthing/README.md index 932258d6db2..cb3f7f80adb 100644 --- a/charts/stable/syncthing/README.md +++ b/charts/stable/syncthing/README.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/syncthing/security.md b/charts/stable/syncthing/security.md index 1346d0eee20..07c957a12bd 100644 --- a/charts/stable/syncthing/security.md +++ b/charts/stable/syncthing/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-syncthing' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/syslog-ng/CHANGELOG.md b/charts/stable/syslog-ng/CHANGELOG.md index fcb9586069e..7bd11aca7cd 100644 --- a/charts/stable/syslog-ng/CHANGELOG.md +++ b/charts/stable/syslog-ng/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [syslog-ng-0.0.8](https://github.com/truecharts/apps/compare/syslog-ng-0.0.7...syslog-ng-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [syslog-ng-0.0.7](https://github.com/truecharts/apps/compare/syslog-ng-0.0.6...syslog-ng-0.0.7) (2021-12-19) diff --git a/charts/stable/syslog-ng/README.md b/charts/stable/syslog-ng/README.md index 023e12a26da..f1eb03f38f7 100644 --- a/charts/stable/syslog-ng/README.md +++ b/charts/stable/syslog-ng/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/syslog-ng/security.md b/charts/stable/syslog-ng/security.md index 10cf66a7480..0c5d3cd71b7 100644 --- a/charts/stable/syslog-ng/security.md +++ b/charts/stable/syslog-ng/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/tautulli/CHANGELOG.md b/charts/stable/tautulli/CHANGELOG.md index 27137bf57bb..d5e62fba340 100644 --- a/charts/stable/tautulli/CHANGELOG.md +++ b/charts/stable/tautulli/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [tautulli-9.0.27](https://github.com/truecharts/apps/compare/tautulli-9.0.26...tautulli-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [tautulli-9.0.26](https://github.com/truecharts/apps/compare/tautulli-9.0.25...tautulli-9.0.26) (2021-12-20) diff --git a/charts/stable/tautulli/README.md b/charts/stable/tautulli/README.md index bae70af4b42..486d7651fda 100644 --- a/charts/stable/tautulli/README.md +++ b/charts/stable/tautulli/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/tautulli/helm-values.md b/charts/stable/tautulli/helm-values.md index 2045b6e7a72..53cf7ca0dbf 100644 --- a/charts/stable/tautulli/helm-values.md +++ b/charts/stable/tautulli/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/tautulli"` | | -| image.tag | string | `"v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6"` | | +| image.tag | string | `"v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | service.main.ports.main.port | int | `8181` | | diff --git a/charts/stable/tautulli/security.md b/charts/stable/tautulli/security.md index d810ac2e59d..935992f8dce 100644 --- a/charts/stable/tautulli/security.md +++ b/charts/stable/tautulli/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-tautulli' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/tautulli:v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6 + tccr.io/truecharts/tautulli:v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/tautulli:v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6 (ubuntu 20.04) +#### Container: tccr.io/truecharts/tautulli:v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -166,4 +158,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/teamspeak3/CHANGELOG.md b/charts/stable/teamspeak3/CHANGELOG.md index b938a81c37f..c3e61dc44b6 100644 --- a/charts/stable/teamspeak3/CHANGELOG.md +++ b/charts/stable/teamspeak3/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [teamspeak3-2.0.26](https://github.com/truecharts/apps/compare/teamspeak3-2.0.25...teamspeak3-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [teamspeak3-2.0.25](https://github.com/truecharts/apps/compare/teamspeak3-2.0.24...teamspeak3-2.0.25) (2021-12-19) diff --git a/charts/stable/teamspeak3/README.md b/charts/stable/teamspeak3/README.md index e10d15f04f5..b9efeafa738 100644 --- a/charts/stable/teamspeak3/README.md +++ b/charts/stable/teamspeak3/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/teamspeak3/security.md b/charts/stable/teamspeak3/security.md index 98d58e6049e..ef6d92df3a9 100644 --- a/charts/stable/teamspeak3/security.md +++ b/charts/stable/teamspeak3/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/teedy/CHANGELOG.md b/charts/stable/teedy/CHANGELOG.md index b8cf718b3ff..0a921f9a08b 100644 --- a/charts/stable/teedy/CHANGELOG.md +++ b/charts/stable/teedy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [teedy-4.0.17](https://github.com/truecharts/apps/compare/teedy-4.0.16...teedy-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [teedy-4.0.16](https://github.com/truecharts/apps/compare/teedy-4.0.15...teedy-4.0.16) (2021-12-19) diff --git a/charts/stable/teedy/README.md b/charts/stable/teedy/README.md index 123cf11b8c8..5434ee03243 100644 --- a/charts/stable/teedy/README.md +++ b/charts/stable/teedy/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/teedy/security.md b/charts/stable/teedy/security.md index 8bc313af444..9920674261a 100644 --- a/charts/stable/teedy/security.md +++ b/charts/stable/teedy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-teedy' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/docs:v1.9@sha256:23e9053e5eb837b31ae08bc770865827c7a2dc49dfc46fa2eba55f18fe8b21da tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1601,8 +1592,8 @@ hide: | com.squareup.okhttp3:okhttp | CVE-2018-20200 | MEDIUM | 3.11.0 | 3.12.1 |
Expand...https://cxsecurity.com/issue/WLB-2018120252
https://github.com/square/okhttp/commits/master
https://github.com/square/okhttp/issues/4967
https://github.com/square/okhttp/releases
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a@%3Cuser.flink.apache.org%3E
https://lists.apache.org/thread.html/r71100f23778d72fbd8be8baa6baffc159b9c4f3fae3db4826bdc8ab8@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r78bfce980843be61a55615a7680bbf7ac751a9b3515231eab2d32068@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rc436d58531754ac8fe20340044566518ea4dce66aeff9193356a225d@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/recce57e195fbdd856dcf1933c136a8a66d7b02e05e3580f44d75a640@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rfd1eed12ba2a5dff37229edd60fc84a25517815d848994146a15af91@%3Cissues.flink.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-20200
https://square.github.io/okhttp/3.x/okhttp/
| | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.6 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | log4j:log4j | CVE-2019-17571 | CRITICAL | 1.2.16 | 2.0-alpha1 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
https://github.com/advisories/GHSA-2qrg-x229-3v8q
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E
https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E
https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E
https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E
https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html
https://nvd.nist.gov/vuln/detail/CVE-2019-17571
https://security.netapp.com/advisory/ntap-20200110-0001/
https://ubuntu.com/security/notices/USN-4495-1
https://usn.ubuntu.com/4495-1/
https://www.debian.org/security/2020/dsa-4686
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
| -| log4j:log4j | CVE-2021-4104 | HIGH | 1.2.16 | |
Expand...https://access.redhat.com/security/cve/CVE-2021-4104
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
https://github.com/advisories/GHSA-fp5r-v3w9-4333
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
https://nvd.nist.gov/vuln/detail/CVE-2021-4104
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/13/1
| -| log4j:log4j | CVE-2020-9488 | LOW | 1.2.16 | 2.13.2 |
Expand...https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| log4j:log4j | CVE-2021-4104 | HIGH | 1.2.16 | |
Expand...https://access.redhat.com/security/cve/CVE-2021-4104
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
https://github.com/advisories/GHSA-fp5r-v3w9-4333
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
https://linux.oracle.com/cve/CVE-2021-4104.html
https://linux.oracle.com/errata/ELSA-2021-5206.html
https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
https://nvd.nist.gov/vuln/detail/CVE-2021-4104
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/13/1
https://www.openwall.com/lists/oss-security/2021/12/13/2
| +| log4j:log4j | CVE-2020-9488 | LOW | 1.2.16 | 2.13.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9488
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b (release-2.x)
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=fb91a3d71e2f3dadad6fd1beb2ab857f44fe8bbb (master)
https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.openwall.com/lists/oss-security/2020/04/25/1
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | log4j:log4j | GMS-2021-5 | UNKNOWN | 1.2.16 | 2.15.0-rc1 |
Expand...https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://www.lunasec.io/docs/blog/log4j-zero-day/
| | org.apache.commons:commons-compress | CVE-2019-12402 | HIGH | 1.18 | 1.19 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12402
https://github.com/advisories/GHSA-53x6-4x5p-rrvv
https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53@%3Cdev.brooklyn.apache.org%3E
https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55@%3Csolr-user.lucene.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/
https://nvd.nist.gov/vuln/detail/CVE-2019-12402
https://www.openwall.com/lists/oss-security/2019/08/27/1
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.commons:commons-compress | CVE-2021-35515 | HIGH | 1.18 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/1
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-7hfm-57qf-j43q
https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-35515
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| @@ -1683,7 +1674,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/thelounge/CHANGELOG.md b/charts/stable/thelounge/CHANGELOG.md index 4eb088ad778..925e7eefd1d 100644 --- a/charts/stable/thelounge/CHANGELOG.md +++ b/charts/stable/thelounge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [thelounge-4.0.28](https://github.com/truecharts/apps/compare/thelounge-4.0.27...thelounge-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [thelounge-4.0.27](https://github.com/truecharts/apps/compare/thelounge-4.0.26...thelounge-4.0.27) (2021-12-19) diff --git a/charts/stable/thelounge/README.md b/charts/stable/thelounge/README.md index 987a63d6cab..1cd552d8038 100644 --- a/charts/stable/thelounge/README.md +++ b/charts/stable/thelounge/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/thelounge/security.md b/charts/stable/thelounge/security.md index b7727a9ad47..76c3db57f25 100644 --- a/charts/stable/thelounge/security.md +++ b/charts/stable/thelounge/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -710,7 +706,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -722,7 +718,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -732,15 +728,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -783,7 +781,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| diff --git a/charts/stable/traccar/CHANGELOG.md b/charts/stable/traccar/CHANGELOG.md index 8b9e20a2377..0fe73adc246 100644 --- a/charts/stable/traccar/CHANGELOG.md +++ b/charts/stable/traccar/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [traccar-4.0.17](https://github.com/truecharts/apps/compare/traccar-4.0.16...traccar-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [traccar-4.0.16](https://github.com/truecharts/apps/compare/traccar-4.0.15...traccar-4.0.16) (2021-12-19) diff --git a/charts/stable/traccar/README.md b/charts/stable/traccar/README.md index dbf87a418eb..1afffb6b34f 100644 --- a/charts/stable/traccar/README.md +++ b/charts/stable/traccar/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/traccar/security.md b/charts/stable/traccar/security.md index a646432ca4c..03322f09265 100644 --- a/charts/stable/traccar/security.md +++ b/charts/stable/traccar/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traccar' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/traccar:v4.14@sha256:39fe3c8c65caef00ab79591c98b383432fe2d21bf745c925df6fd7891ce6fe78 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -415,7 +406,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/transmission/CHANGELOG.md b/charts/stable/transmission/CHANGELOG.md index 0be17ac41a0..72c9a9a5798 100644 --- a/charts/stable/transmission/CHANGELOG.md +++ b/charts/stable/transmission/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [transmission-10.0.7](https://github.com/truecharts/apps/compare/transmission-10.0.6...transmission-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [transmission-10.0.6](https://github.com/truecharts/apps/compare/transmission-10.0.5...transmission-10.0.6) (2021-12-19) diff --git a/charts/stable/transmission/README.md b/charts/stable/transmission/README.md index 7994eef2483..31693b468e6 100644 --- a/charts/stable/transmission/README.md +++ b/charts/stable/transmission/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/transmission/security.md b/charts/stable/transmission/security.md index 37f2833d636..bac3fe5ca8d 100644 --- a/charts/stable/transmission/security.md +++ b/charts/stable/transmission/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-transmission' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -172,4 +169,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/truecommand/CHANGELOG.md b/charts/stable/truecommand/CHANGELOG.md index 6bf21ebc491..f777a8b47a8 100644 --- a/charts/stable/truecommand/CHANGELOG.md +++ b/charts/stable/truecommand/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [truecommand-9.0.27](https://github.com/truecharts/apps/compare/truecommand-9.0.26...truecommand-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [truecommand-9.0.26](https://github.com/truecharts/apps/compare/truecommand-9.0.25...truecommand-9.0.26) (2021-12-19) diff --git a/charts/stable/truecommand/README.md b/charts/stable/truecommand/README.md index 5ae473e45fd..b6145b1e0cd 100644 --- a/charts/stable/truecommand/README.md +++ b/charts/stable/truecommand/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/truecommand/security.md b/charts/stable/truecommand/security.md index 26d2846846f..ff89f63bd28 100644 --- a/charts/stable/truecommand/security.md +++ b/charts/stable/truecommand/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -400,22 +396,22 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/buger/jsonparser | CVE-2020-10675 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v0.0.0-20200321185410-91ac96899e49 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10675
https://github.com/buger/jsonparser/issues/188
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/
https://nvd.nist.gov/vuln/detail/CVE-2020-10675
| -| github.com/buger/jsonparser | CVE-2020-35381 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v1.1.1 |
Expand...https://github.com/buger/jsonparser/issues/219
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27EA7OGCELV7QFAGVIHODHWKMKGFVIUZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJO5N7YTDEUSTKYTNA372CE6VHCZJWUG/
https://nvd.nist.gov/vuln/detail/CVE-2020-35381
| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | v1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| +| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | 1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/buger/jsonparser | CVE-2020-10675 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v0.0.0-20200321185410-91ac96899e49 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10675
https://github.com/buger/jsonparser/issues/188
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/
https://nvd.nist.gov/vuln/detail/CVE-2020-10675
| -| github.com/buger/jsonparser | CVE-2020-35381 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v1.1.1 |
Expand...https://github.com/buger/jsonparser/issues/219
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27EA7OGCELV7QFAGVIHODHWKMKGFVIUZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJO5N7YTDEUSTKYTNA372CE6VHCZJWUG/
https://nvd.nist.gov/vuln/detail/CVE-2020-35381
| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | v1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| +| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | 1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| **gobinary** @@ -423,6 +419,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** diff --git a/charts/stable/tt-rss/CHANGELOG.md b/charts/stable/tt-rss/CHANGELOG.md index 45dfacd1c3d..bfffd7a890f 100644 --- a/charts/stable/tt-rss/CHANGELOG.md +++ b/charts/stable/tt-rss/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tt-rss-4.0.26](https://github.com/truecharts/apps/compare/tt-rss-4.0.25...tt-rss-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tt-rss-4.0.25](https://github.com/truecharts/apps/compare/tt-rss-4.0.24...tt-rss-4.0.25) (2021-12-20) diff --git a/charts/stable/tt-rss/README.md b/charts/stable/tt-rss/README.md index 151597ca993..f82f0be63db 100644 --- a/charts/stable/tt-rss/README.md +++ b/charts/stable/tt-rss/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/tt-rss/security.md b/charts/stable/tt-rss/security.md index d4c203c55b7..f2736b6ba81 100644 --- a/charts/stable/tt-rss/security.md +++ b/charts/stable/tt-rss/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/tt-rss:v1.9082.0@sha256:20322392e459f2e35f67a855449416dabe335bbe4d9d4b657dcf2f998fa38558 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -464,7 +454,9 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -499,7 +491,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/tvheadend/CHANGELOG.md b/charts/stable/tvheadend/CHANGELOG.md index 8446cdac537..c15d0f3aa9c 100644 --- a/charts/stable/tvheadend/CHANGELOG.md +++ b/charts/stable/tvheadend/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tvheadend-10.0.26](https://github.com/truecharts/apps/compare/tvheadend-10.0.25...tvheadend-10.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tvheadend-10.0.25](https://github.com/truecharts/apps/compare/tvheadend-10.0.24...tvheadend-10.0.25) (2021-12-19) diff --git a/charts/stable/tvheadend/README.md b/charts/stable/tvheadend/README.md index 11c5b9c52a2..b208d81574b 100644 --- a/charts/stable/tvheadend/README.md +++ b/charts/stable/tvheadend/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/tvheadend/security.md b/charts/stable/tvheadend/security.md index 232ccc2d222..34f7412390f 100644 --- a/charts/stable/tvheadend/security.md +++ b/charts/stable/tvheadend/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/twtxt/CHANGELOG.md b/charts/stable/twtxt/CHANGELOG.md index 5f1e73ef8db..b99a042a698 100644 --- a/charts/stable/twtxt/CHANGELOG.md +++ b/charts/stable/twtxt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [twtxt-1.0.26](https://github.com/truecharts/apps/compare/twtxt-1.0.25...twtxt-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [twtxt-1.0.25](https://github.com/truecharts/apps/compare/twtxt-1.0.24...twtxt-1.0.25) (2021-12-19) diff --git a/charts/stable/twtxt/README.md b/charts/stable/twtxt/README.md index b76f602eb6e..bf0bb5d0685 100644 --- a/charts/stable/twtxt/README.md +++ b/charts/stable/twtxt/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/twtxt/security.md b/charts/stable/twtxt/security.md index 4bc59cfecc6..31a0954bedd 100644 --- a/charts/stable/twtxt/security.md +++ b/charts/stable/twtxt/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -84,3 +80,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200709230013-948cd5f35899 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/charts/stable/ubooquity/CHANGELOG.md b/charts/stable/ubooquity/CHANGELOG.md index b445118d718..d69cda3b17f 100644 --- a/charts/stable/ubooquity/CHANGELOG.md +++ b/charts/stable/ubooquity/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ubooquity-0.0.7](https://github.com/truecharts/apps/compare/ubooquity-0.0.6...ubooquity-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ubooquity-0.0.6](https://github.com/truecharts/apps/compare/ubooquity-0.0.5...ubooquity-0.0.6) (2021-12-19) diff --git a/charts/stable/ubooquity/README.md b/charts/stable/ubooquity/README.md index 2e6d8d808d4..4c872760c72 100644 --- a/charts/stable/ubooquity/README.md +++ b/charts/stable/ubooquity/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/ubooquity/security.md b/charts/stable/ubooquity/security.md index da7a59fe5e5..c5100765a69 100644 --- a/charts/stable/ubooquity/security.md +++ b/charts/stable/ubooquity/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/unifi/CHANGELOG.md b/charts/stable/unifi/CHANGELOG.md index 6d4adca99cf..33087dd6b05 100644 --- a/charts/stable/unifi/CHANGELOG.md +++ b/charts/stable/unifi/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unifi-9.0.30](https://github.com/truecharts/apps/compare/unifi-9.0.29...unifi-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unifi-9.0.29](https://github.com/truecharts/apps/compare/unifi-9.0.28...unifi-9.0.29) (2021-12-19) diff --git a/charts/stable/unifi/README.md b/charts/stable/unifi/README.md index 764c8b2bf21..14012b38cc6 100644 --- a/charts/stable/unifi/README.md +++ b/charts/stable/unifi/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/unifi/security.md b/charts/stable/unifi/security.md index b0cf6572347..b2c8d688be1 100644 --- a/charts/stable/unifi/security.md +++ b/charts/stable/unifi/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -240,7 +236,7 @@ hide: | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.6 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | io.springfox:springfox-swagger-ui | CVE-2019-17495 | CRITICAL | 2.9.2 | 2.10.0 |
Expand...https://github.com/advisories/GHSA-c427-hjc3-wrfw
https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
https://github.com/tarantula-team/CSS-injection-in-Swagger-UI
https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f@%3Ccommits.airflow.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-17495
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.10 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-13934 | HIGH | 8.5.56 | 8.5.57, 9.0.37 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E
http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13934
https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
https://nvd.nist.gov/vuln/detail/CVE-2020-13934
https://security.netapp.com/advisory/ntap-20200724-0003/
https://ubuntu.com/security/notices/USN-4596-1
https://usn.ubuntu.com/4596-1/
https://www.debian.org/security/2020/dsa-4727
https://www.openwall.com/lists/oss-security/2020/07/14/4
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 8.5.56 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 8.5.56 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/charts/stable/unpackerr/CHANGELOG.md b/charts/stable/unpackerr/CHANGELOG.md index 240a0171645..7337c9f1258 100644 --- a/charts/stable/unpackerr/CHANGELOG.md +++ b/charts/stable/unpackerr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unpackerr-4.0.28](https://github.com/truecharts/apps/compare/unpackerr-4.0.27...unpackerr-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unpackerr-4.0.27](https://github.com/truecharts/apps/compare/unpackerr-4.0.26...unpackerr-4.0.27) (2021-12-19) diff --git a/charts/stable/unpackerr/README.md b/charts/stable/unpackerr/README.md index 94a5ac29321..cb217459721 100644 --- a/charts/stable/unpackerr/README.md +++ b/charts/stable/unpackerr/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/unpackerr/security.md b/charts/stable/unpackerr/security.md index ae32938edd2..3964ecdb832 100644 --- a/charts/stable/unpackerr/security.md +++ b/charts/stable/unpackerr/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-unpackerr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/unpoller/CHANGELOG.md b/charts/stable/unpoller/CHANGELOG.md index e259e324e62..5e6fb9c48fb 100644 --- a/charts/stable/unpoller/CHANGELOG.md +++ b/charts/stable/unpoller/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unpoller-1.0.18](https://github.com/truecharts/apps/compare/unpoller-1.0.17...unpoller-1.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unpoller-1.0.17](https://github.com/truecharts/apps/compare/unpoller-1.0.16...unpoller-1.0.17) (2021-12-20) diff --git a/charts/stable/unpoller/README.md b/charts/stable/unpoller/README.md index 08c689ffb1f..5706a19d706 100644 --- a/charts/stable/unpoller/README.md +++ b/charts/stable/unpoller/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/unpoller/security.md b/charts/stable/unpoller/security.md index f2da380fd47..477fbdce862 100644 --- a/charts/stable/unpoller/security.md +++ b/charts/stable/unpoller/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-unpoller' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/uptime-kuma/CHANGELOG.md b/charts/stable/uptime-kuma/CHANGELOG.md index c59bf223e9f..335c126c503 100644 --- a/charts/stable/uptime-kuma/CHANGELOG.md +++ b/charts/stable/uptime-kuma/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [uptime-kuma-1.0.27](https://github.com/truecharts/apps/compare/uptime-kuma-1.0.26...uptime-kuma-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [uptime-kuma-1.0.26](https://github.com/truecharts/apps/compare/uptime-kuma-1.0.25...uptime-kuma-1.0.26) (2021-12-19) diff --git a/charts/stable/uptime-kuma/README.md b/charts/stable/uptime-kuma/README.md index a53cace4bd4..597feda9f31 100644 --- a/charts/stable/uptime-kuma/README.md +++ b/charts/stable/uptime-kuma/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/uptime-kuma/security.md b/charts/stable/uptime-kuma/security.md index 6b655452724..bc4a216abd8 100644 --- a/charts/stable/uptime-kuma/security.md +++ b/charts/stable/uptime-kuma/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/uptimerobot-prometheus/CHANGELOG.md b/charts/stable/uptimerobot-prometheus/CHANGELOG.md index 000a2aaf6bd..12caff65ec2 100644 --- a/charts/stable/uptimerobot-prometheus/CHANGELOG.md +++ b/charts/stable/uptimerobot-prometheus/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [uptimerobot-prometheus-2.0.7](https://github.com/truecharts/apps/compare/uptimerobot-prometheus-2.0.6...uptimerobot-prometheus-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [uptimerobot-prometheus-2.0.6](https://github.com/truecharts/apps/compare/uptimerobot-prometheus-2.0.5...uptimerobot-prometheus-2.0.6) (2021-12-19) diff --git a/charts/stable/uptimerobot-prometheus/README.md b/charts/stable/uptimerobot-prometheus/README.md index cf0c89e0efb..e221c76938b 100644 --- a/charts/stable/uptimerobot-prometheus/README.md +++ b/charts/stable/uptimerobot-prometheus/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/uptimerobot-prometheus/security.md b/charts/stable/uptimerobot-prometheus/security.md index 25d4a6920e7..7eed8e4b5b3 100644 --- a/charts/stable/uptimerobot-prometheus/security.md +++ b/charts/stable/uptimerobot-prometheus/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/valheim/CHANGELOG.md b/charts/stable/valheim/CHANGELOG.md index 40a4d37c2ed..3ddf7d9a96c 100644 --- a/charts/stable/valheim/CHANGELOG.md +++ b/charts/stable/valheim/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [valheim-2.0.7](https://github.com/truecharts/apps/compare/valheim-2.0.6...valheim-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [valheim-2.0.6](https://github.com/truecharts/apps/compare/valheim-2.0.5...valheim-2.0.6) (2021-12-19) diff --git a/charts/stable/valheim/README.md b/charts/stable/valheim/README.md index 3ce6cae154d..17c86e8a8c4 100644 --- a/charts/stable/valheim/README.md +++ b/charts/stable/valheim/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/valheim/security.md b/charts/stable/valheim/security.md index 8c56c300d15..2c0610446a7 100644 --- a/charts/stable/valheim/security.md +++ b/charts/stable/valheim/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -354,7 +350,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -373,7 +369,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -383,13 +379,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -436,7 +434,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | locales | CVE-2021-33574 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | locales | CVE-2021-35942 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | locales | CVE-2020-1751 | HIGH | 2.28-10 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751
https://linux.oracle.com/cve/CVE-2020-1751.html
https://linux.oracle.com/errata/ELSA-2020-4444.html
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://ubuntu.com/security/notices/USN-4416-1
https://usn.ubuntu.com/4416-1/
| diff --git a/charts/stable/vaultwarden/CHANGELOG.md b/charts/stable/vaultwarden/CHANGELOG.md index 3c60334ef94..89032fa940f 100644 --- a/charts/stable/vaultwarden/CHANGELOG.md +++ b/charts/stable/vaultwarden/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [vaultwarden-13.0.18](https://github.com/truecharts/apps/compare/vaultwarden-13.0.17...vaultwarden-13.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [vaultwarden-13.0.17](https://github.com/truecharts/apps/compare/vaultwarden-13.0.16...vaultwarden-13.0.17) (2021-12-19) diff --git a/charts/stable/vaultwarden/README.md b/charts/stable/vaultwarden/README.md index a216d617002..9b3595c4725 100644 --- a/charts/stable/vaultwarden/README.md +++ b/charts/stable/vaultwarden/README.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/vaultwarden/security.md b/charts/stable/vaultwarden/security.md index bf526c178dc..e6ed3482087 100644 --- a/charts/stable/vaultwarden/security.md +++ b/charts/stable/vaultwarden/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-vaultwarden' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/vaultwarden:v1.23.1@sha256:094eae865c2650b033313228359aafdef5f00008b8f44cb856ee418270cebdf9 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -526,7 +517,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -545,7 +536,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -555,13 +546,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -608,7 +601,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -663,7 +660,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/webgrabplus/CHANGELOG.md b/charts/stable/webgrabplus/CHANGELOG.md index 6256d1fdddb..f8b3bf9d24a 100644 --- a/charts/stable/webgrabplus/CHANGELOG.md +++ b/charts/stable/webgrabplus/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [webgrabplus-0.0.8](https://github.com/truecharts/apps/compare/webgrabplus-0.0.7...webgrabplus-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [webgrabplus-0.0.7](https://github.com/truecharts/apps/compare/webgrabplus-0.0.6...webgrabplus-0.0.7) (2021-12-19) diff --git a/charts/stable/webgrabplus/README.md b/charts/stable/webgrabplus/README.md index dd0b5644a3a..653e2b40a74 100644 --- a/charts/stable/webgrabplus/README.md +++ b/charts/stable/webgrabplus/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/webgrabplus/security.md b/charts/stable/webgrabplus/security.md index 1a531f2bac4..3814df178ab 100644 --- a/charts/stable/webgrabplus/security.md +++ b/charts/stable/webgrabplus/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/whoogle/CHANGELOG.md b/charts/stable/whoogle/CHANGELOG.md index 2ed26384612..ea5efa55963 100644 --- a/charts/stable/whoogle/CHANGELOG.md +++ b/charts/stable/whoogle/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [whoogle-1.0.27](https://github.com/truecharts/apps/compare/whoogle-1.0.26...whoogle-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [whoogle-1.0.26](https://github.com/truecharts/apps/compare/whoogle-1.0.25...whoogle-1.0.26) (2021-12-20) diff --git a/charts/stable/whoogle/README.md b/charts/stable/whoogle/README.md index d524c472efa..387dbe7619e 100644 --- a/charts/stable/whoogle/README.md +++ b/charts/stable/whoogle/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/whoogle/security.md b/charts/stable/whoogle/security.md index bce45ad1286..a7e34276a0c 100644 --- a/charts/stable/whoogle/security.md +++ b/charts/stable/whoogle/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/wikijs/CHANGELOG.md b/charts/stable/wikijs/CHANGELOG.md index d98aafb1204..74abf3a542c 100644 --- a/charts/stable/wikijs/CHANGELOG.md +++ b/charts/stable/wikijs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [wikijs-4.0.17](https://github.com/truecharts/apps/compare/wikijs-4.0.16...wikijs-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [wikijs-4.0.16](https://github.com/truecharts/apps/compare/wikijs-4.0.15...wikijs-4.0.16) (2021-12-20) diff --git a/charts/stable/wikijs/README.md b/charts/stable/wikijs/README.md index 5331ebc6cce..efca9ec917d 100644 --- a/charts/stable/wikijs/README.md +++ b/charts/stable/wikijs/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/wikijs/security.md b/charts/stable/wikijs/security.md index f5ea2ef4a2d..230621dfa77 100644 --- a/charts/stable/wikijs/security.md +++ b/charts/stable/wikijs/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/wikijs:v2.5.260@sha256:49e014e4774c5cbbbcc9327f437224b748547859ca540211e63051ed60461c5b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -388,7 +378,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/charts/stable/wireshark/CHANGELOG.md b/charts/stable/wireshark/CHANGELOG.md index 505856926cd..042b7095612 100644 --- a/charts/stable/wireshark/CHANGELOG.md +++ b/charts/stable/wireshark/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [wireshark-0.0.7](https://github.com/truecharts/apps/compare/wireshark-0.0.6...wireshark-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [wireshark-0.0.6](https://github.com/truecharts/apps/compare/wireshark-0.0.5...wireshark-0.0.6) (2021-12-19) diff --git a/charts/stable/wireshark/README.md b/charts/stable/wireshark/README.md index 44bd0d850e1..67018162362 100644 --- a/charts/stable/wireshark/README.md +++ b/charts/stable/wireshark/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/wireshark/security.md b/charts/stable/wireshark/security.md index d0f20e8fa9b..ddd1345b5d4 100644 --- a/charts/stable/wireshark/security.md +++ b/charts/stable/wireshark/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -392,3 +389,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/charts/stable/xbackbone/CHANGELOG.md b/charts/stable/xbackbone/CHANGELOG.md index d0d17a2f5ce..9c66cc4f8e4 100644 --- a/charts/stable/xbackbone/CHANGELOG.md +++ b/charts/stable/xbackbone/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [xbackbone-0.0.15](https://github.com/truecharts/apps/compare/xbackbone-0.0.14...xbackbone-0.0.15) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [xbackbone-0.0.14](https://github.com/truecharts/apps/compare/xbackbone-0.0.13...xbackbone-0.0.14) (2021-12-19) diff --git a/charts/stable/xbackbone/README.md b/charts/stable/xbackbone/README.md index e8448d64ce3..5cdfb986426 100644 --- a/charts/stable/xbackbone/README.md +++ b/charts/stable/xbackbone/README.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/xbackbone/security.md b/charts/stable/xbackbone/security.md index 438ee453ae5..95f90bc1b83 100644 --- a/charts/stable/xbackbone/security.md +++ b/charts/stable/xbackbone/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/xbackbone:v3.3.3@sha256:c22e8806732b5a63a9761d413f4dd3a39af9427a12818e8ff769094ebc141c99 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -499,7 +491,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/charts/stable/xteve/CHANGELOG.md b/charts/stable/xteve/CHANGELOG.md index ca86eeee9c9..7a873308232 100644 --- a/charts/stable/xteve/CHANGELOG.md +++ b/charts/stable/xteve/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [xteve-4.0.26](https://github.com/truecharts/apps/compare/xteve-4.0.25...xteve-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [xteve-4.0.25](https://github.com/truecharts/apps/compare/xteve-4.0.24...xteve-4.0.25) (2021-12-19) diff --git a/charts/stable/xteve/README.md b/charts/stable/xteve/README.md index ac28ae96d10..51a70450fe9 100644 --- a/charts/stable/xteve/README.md +++ b/charts/stable/xteve/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/xteve/security.md b/charts/stable/xteve/security.md index b1a18ab3ffe..c70a12079ce 100644 --- a/charts/stable/xteve/security.md +++ b/charts/stable/xteve/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-xteve' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -781,4 +778,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/charts/stable/zigbee2mqtt/CHANGELOG.md b/charts/stable/zigbee2mqtt/CHANGELOG.md index cc0ff3a97d9..86ff9c43a92 100644 --- a/charts/stable/zigbee2mqtt/CHANGELOG.md +++ b/charts/stable/zigbee2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [zigbee2mqtt-1.0.27](https://github.com/truecharts/apps/compare/zigbee2mqtt-1.0.26...zigbee2mqtt-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [zigbee2mqtt-1.0.26](https://github.com/truecharts/apps/compare/zigbee2mqtt-1.0.25...zigbee2mqtt-1.0.26) (2021-12-19) diff --git a/charts/stable/zigbee2mqtt/README.md b/charts/stable/zigbee2mqtt/README.md index 555a1188ce6..da5f052400a 100644 --- a/charts/stable/zigbee2mqtt/README.md +++ b/charts/stable/zigbee2mqtt/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/zigbee2mqtt/security.md b/charts/stable/zigbee2mqtt/security.md index 093ba44f302..011da8037af 100644 --- a/charts/stable/zigbee2mqtt/security.md +++ b/charts/stable/zigbee2mqtt/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/charts/stable/znc/CHANGELOG.md b/charts/stable/znc/CHANGELOG.md index 8f1726f14a2..ac517550530 100644 --- a/charts/stable/znc/CHANGELOG.md +++ b/charts/stable/znc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [znc-0.0.7](https://github.com/truecharts/apps/compare/znc-0.0.6...znc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [znc-0.0.6](https://github.com/truecharts/apps/compare/znc-0.0.5...znc-0.0.6) (2021-12-19) diff --git a/charts/stable/znc/README.md b/charts/stable/znc/README.md index 918da426712..e7391905816 100644 --- a/charts/stable/znc/README.md +++ b/charts/stable/znc/README.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/znc/security.md b/charts/stable/znc/security.md index dfdff83c935..c5188382998 100644 --- a/charts/stable/znc/security.md +++ b/charts/stable/znc/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/charts/stable/zwavejs2mqtt/CHANGELOG.md b/charts/stable/zwavejs2mqtt/CHANGELOG.md index a6d393d09a2..eb3a2aa22e8 100644 --- a/charts/stable/zwavejs2mqtt/CHANGELOG.md +++ b/charts/stable/zwavejs2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [zwavejs2mqtt-9.0.33](https://github.com/truecharts/apps/compare/zwavejs2mqtt-9.0.32...zwavejs2mqtt-9.0.33) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [zwavejs2mqtt-9.0.32](https://github.com/truecharts/apps/compare/zwavejs2mqtt-9.0.31...zwavejs2mqtt-9.0.32) (2021-12-20) diff --git a/charts/stable/zwavejs2mqtt/README.md b/charts/stable/zwavejs2mqtt/README.md index 84a60c8b503..e5752139a06 100644 --- a/charts/stable/zwavejs2mqtt/README.md +++ b/charts/stable/zwavejs2mqtt/README.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/charts/stable/zwavejs2mqtt/security.md b/charts/stable/zwavejs2mqtt/security.md index ba45ef7afeb..3b7773321b9 100644 --- a/charts/stable/zwavejs2mqtt/security.md +++ b/charts/stable/zwavejs2mqtt/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/core/k8s-gateway/CHANGELOG.md b/docs/apps/core/k8s-gateway/CHANGELOG.md index 06914596f8b..b59ac4f37a6 100644 --- a/docs/apps/core/k8s-gateway/CHANGELOG.md +++ b/docs/apps/core/k8s-gateway/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [k8s-gateway-4.0.26](https://github.com/truecharts/apps/compare/k8s-gateway-4.0.25...k8s-gateway-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [k8s-gateway-4.0.25](https://github.com/truecharts/apps/compare/k8s-gateway-4.0.24...k8s-gateway-4.0.25) (2021-12-19) diff --git a/docs/apps/core/k8s-gateway/index.md b/docs/apps/core/k8s-gateway/index.md index fb31303ec73..30dde411861 100644 --- a/docs/apps/core/k8s-gateway/index.md +++ b/docs/apps/core/k8s-gateway/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/core/k8s-gateway/security.md b/docs/apps/core/k8s-gateway/security.md index 17f2db517d1..0add1f22212 100644 --- a/docs/apps/core/k8s-gateway/security.md +++ b/docs/apps/core/k8s-gateway/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-k8s-gateway' of Deployment 'RELEASE-NAME-k8s-gateway' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -81,4 +77,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| go.etcd.io/etcd | CVE-2020-15106 | MEDIUM | v0.5.0-alpha.5.0.20200306183522-221f0cc107cb | v0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15106
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
| +| go.etcd.io/etcd | CVE-2020-15106 | MEDIUM | v0.5.0-alpha.5.0.20200306183522-221f0cc107cb | 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15106
https://github.com/etcd-io/etcd/security/advisories/GHSA-p4g4-wgrh-qrg2
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/docs/apps/core/prometheus/CHANGELOG.md b/docs/apps/core/prometheus/CHANGELOG.md index 71575f7554c..300bcf5a5de 100644 --- a/docs/apps/core/prometheus/CHANGELOG.md +++ b/docs/apps/core/prometheus/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [prometheus-1.1.27](https://github.com/truecharts/apps/compare/prometheus-1.1.26...prometheus-1.1.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [prometheus-1.1.26](https://github.com/truecharts/apps/compare/prometheus-1.1.25...prometheus-1.1.26) (2021-12-20) diff --git a/docs/apps/core/prometheus/helm-values.md b/docs/apps/core/prometheus/helm-values.md index 1744fb6575b..9278bf609fe 100644 --- a/docs/apps/core/prometheus/helm-values.md +++ b/docs/apps/core/prometheus/helm-values.md @@ -88,7 +88,7 @@ You will, however, be able to use all values referenced in the common chart here | alertmanager.volumeMounts | list | `[]` | | | alertmanager.volumes | list | `[]` | | | alertmanagerImage.repository | string | `"tccr.io/truecharts/alertmanager"` | | -| alertmanagerImage.tag | string | `"v0.23.0@sha256:a60e78b7c55a3a4f541e93471b521ee183bd299bd6a1631e300dc1ddda02f8f1"` | | +| alertmanagerImage.tag | string | `"v0.23.0@sha256:a367a332ed5ca80f49219f3b53680cac1b866b80cad39c2d1b003f8068536cf8"` | | | coreDns.enabled | bool | `true` | | | coreDns.namespace | string | `"kube-system"` | | | coreDns.service.enabled | bool | `true` | | @@ -317,7 +317,7 @@ You will, however, be able to use all values referenced in the common chart here | prometheus.volumes | list | `[]` | | | prometheus.walCompression | bool | `false` | | | prometheusImage.repository | string | `"tccr.io/truecharts/prometheus"` | | -| prometheusImage.tag | string | `"v2.32.1@sha256:98e8a2e885ae6b8b9625fc0c987d30b5040ce921f46af2f7ba70c2edb42b4eee"` | | +| prometheusImage.tag | string | `"v2.32.1@sha256:71ad47195bb1d4334a7b77d358f67037639c34cf887c7fa95abc2a9c567bee43"` | | | rbac | object | `{"enabled":true,"rules":[{"apiGroups":["apiextensions.k8s.io"],"resources":["customresourcedefinitions"],"verbs":["create"]},{"apiGroups":["apiextensions.k8s.io"],"resourceNames":["alertmanagers.monitoring.coreos.com","podmonitors.monitoring.coreos.com","prometheuses.monitoring.coreos.com","prometheusrules.monitoring.coreos.com","servicemonitors.monitoring.coreos.com","thanosrulers.monitoring.coreos.com","probes.monitoring.coreos.com"],"resources":["customresourcedefinitions"],"verbs":["get","update"]},{"apiGroups":["monitoring.coreos.com"],"resources":["alertmanagers","alertmanagers/finalizers","alertmanagerconfigs","prometheuses","prometheuses/finalizers","thanosrulers","thanosrulers/finalizers","servicemonitors","podmonitors","probes","prometheusrules"],"verbs":["*"]},{"apiGroups":["apps"],"resources":["statefulsets"],"verbs":["*"]},{"apiGroups":[""],"resources":["configmaps","secrets"],"verbs":["*"]},{"apiGroups":[""],"resources":["pods"],"verbs":["list","delete"]},{"apiGroups":[""],"resources":["services","services/finalizers","endpoints"],"verbs":["get","create","update","delete"]},{"apiGroups":[""],"resources":["nodes"],"verbs":["list","watch"]},{"apiGroups":[""],"resources":["namespaces"],"verbs":["get","list","watch"]},{"apiGroups":["networking.k8s.io"],"resources":["ingresses"],"verbs":["get","list","watch"]}]}` | Whether Role Based Access Control objects like roles and rolebindings should be created | | securityContext.readOnlyRootFilesystem | bool | `false` | | | service.alertmanager.enabled | bool | `true` | | diff --git a/docs/apps/core/prometheus/index.md b/docs/apps/core/prometheus/index.md index 9dbd0bae26f..100883a5b56 100644 --- a/docs/apps/core/prometheus/index.md +++ b/docs/apps/core/prometheus/index.md @@ -20,7 +20,7 @@ Kubernetes: `>=1.16.0-0` |------------|------|---------| | https://charts.bitnami.com/bitnami | kube-state-metrics | 2.1.19 | | https://charts.bitnami.com/bitnami | node-exporter | 2.3.17 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/core/prometheus/security.md b/docs/apps/core/prometheus/security.md index 0f968ef0aec..f3c55d383dc 100644 --- a/docs/apps/core/prometheus/security.md +++ b/docs/apps/core/prometheus/security.md @@ -25,9 +25,9 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'kube-state-metrics' of Deployment 'RELEASE-NAME-kube-state-metrics' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-kube-state-metrics' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -55,15 +55,14 @@ hide: | Kubernetes Security Check | KSV009 | Access to host network | HIGH |
Expand... Sharing the host’s network namespace permits processes in the pod to communicate with processes bound to the host’s loopback adapter.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostNetwork' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv009
| | Kubernetes Security Check | KSV010 | Access to host PID | HIGH |
Expand... Sharing the host’s PID namespace allows visibility on host processes, potentially leaking information such as environment variables and configuration.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.spec.hostPID' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv010
| | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| -| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'node-exporter' of DaemonSet 'RELEASE-NAME-node-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV023 | hostPath volumes mounted | MEDIUM |
Expand... HostPath volumes must be forbidden.

DaemonSet 'RELEASE-NAME-node-exporter' should not set 'spec.template.volumes.hostPath'
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv023
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

DaemonSet 'RELEASE-NAME-node-exporter' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -98,9 +97,7 @@ hide: | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| | Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| @@ -122,12 +119,6 @@ hide: | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prometheus' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'alertmanager' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -140,6 +131,7 @@ hide: | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'config-reloader' of Alertmanager 'RELEASE-NAME-prometheus-alertmanager' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'config-reloader' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'prometheus' of Prometheus 'RELEASE-NAME-prometheus-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-prometheus' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -540,10 +532,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: bitnami/kube-state-metrics:2.3.0-debian-10-r0 (debian 10.11) diff --git a/docs/apps/core/traefik/CHANGELOG.md b/docs/apps/core/traefik/CHANGELOG.md index ffcedb218c2..8a7b9e64788 100644 --- a/docs/apps/core/traefik/CHANGELOG.md +++ b/docs/apps/core/traefik/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [traefik-10.0.29](https://github.com/truecharts/apps/compare/traefik-10.0.28...traefik-10.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [traefik-10.0.28](https://github.com/truecharts/apps/compare/traefik-10.0.27...traefik-10.0.28) (2021-12-19) diff --git a/docs/apps/core/traefik/index.md b/docs/apps/core/traefik/index.md index ef22a86294b..bbd5b57d7e5 100644 --- a/docs/apps/core/traefik/index.md +++ b/docs/apps/core/traefik/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/core/traefik/security.md b/docs/apps/core/traefik/security.md index 59ba60331b9..7a5629215da 100644 --- a/docs/apps/core/traefik/security.md +++ b/docs/apps/core/traefik/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traefik' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | No Misconfigurations found | @@ -97,5 +94,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/docs/apps/incubator/omada-controller/CHANGELOG.md b/docs/apps/incubator/omada-controller/CHANGELOG.md index 03022927ed5..13aee3bd21b 100644 --- a/docs/apps/incubator/omada-controller/CHANGELOG.md +++ b/docs/apps/incubator/omada-controller/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [omada-controller-4.0.37](https://github.com/truecharts/apps/compare/omada-controller-4.0.36...omada-controller-4.0.37) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [omada-controller-4.0.36](https://github.com/truecharts/apps/compare/omada-controller-4.0.35...omada-controller-4.0.36) (2021-12-20) diff --git a/docs/apps/incubator/omada-controller/index.md b/docs/apps/incubator/omada-controller/index.md index fed445b9a42..c00c19f5b77 100644 --- a/docs/apps/incubator/omada-controller/index.md +++ b/docs/apps/incubator/omada-controller/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/incubator/omada-controller/security.md b/docs/apps/incubator/omada-controller/security.md index e5a20b09108..1ce6222ecb4 100644 --- a/docs/apps/incubator/omada-controller/security.md +++ b/docs/apps/incubator/omada-controller/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-omada-controller' of Deployment 'RELEASE-NAME-omada-controller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -249,7 +245,7 @@ hide: | commons-beanutils:commons-beanutils | CVE-2019-10086 | HIGH | 1.9.3 | 1.9.4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e
https://access.redhat.com/errata/RHSA-2019:4317
https://access.redhat.com/errata/RHSA-2020:0057
https://access.redhat.com/errata/RHSA-2020:0194
https://access.redhat.com/errata/RHSA-2020:0804
https://access.redhat.com/errata/RHSA-2020:0805
https://access.redhat.com/errata/RHSA-2020:0806
https://access.redhat.com/errata/RHSA-2020:0811
https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086
https://github.com/advisories/GHSA-6phf-73q6-gh87
https://github.com/apache/commons-beanutils/commit/dd48f4e589462a8cdb1f29bbbccb35d6b0291d58
https://github.com/apache/commons-beanutils/pull/7
https://issues.apache.org/jira/browse/BEANUTILS-520
https://linux.oracle.com/cve/CVE-2019-10086.html
https://linux.oracle.com/errata/ELSA-2020-0194.html
https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E
https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db@%3Cdev.rocketmq.apache.org%3E
https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825@%3Ccommits.dolphinscheduler.apache.org%3E
https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E
https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%3E
https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E
https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E
https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/
https://nvd.nist.gov/vuln/detail/CVE-2019-10086
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.2 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.7 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.poi:poi | CVE-2017-12626 | HIGH | 3.15 | 3.17 |
Expand...http://www.securityfocus.com/bid/102879
https://access.redhat.com/errata/RHSA-2018:1322
https://bz.apache.org/bugzilla/show_bug.cgi?id=52372
https://bz.apache.org/bugzilla/show_bug.cgi?id=61294
https://bz.apache.org/bugzilla/show_bug.cgi?id=61295
https://bz.apache.org/bugzilla/show_bug.cgi?id=61338
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12626
https://github.com/advisories/GHSA-523c-xh4g-mh5m
https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-12626
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.poi:poi | CVE-2019-12415 | MEDIUM | 3.15 | 4.1.1 |
Expand...https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c@%3Cuser.tika.apache.org%3E
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-12415
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.shiro:shiro-core | CVE-2020-11989 | CRITICAL | 1.4.0 | 1.5.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11989
https://github.com/advisories/GHSA-72w9-fcj5-3fcg
https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249d646d7abadb807ebf90f6fd2b014df21@%3Cdev.geode.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675@%3Cuser.shiro.apache.org%3E
https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rcf3d8041e1232201fe5d74fc612a193e435784d64002409b448b58fe@%3Cdev.geode.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-11989
https://ubuntu.com/security/notices/USN-4740-1
https://www.openwall.com/lists/oss-security/2020/06/22/1
| diff --git a/docs/apps/incubator/tdarr-node/CHANGELOG.md b/docs/apps/incubator/tdarr-node/CHANGELOG.md index 549f1d9a5dc..869ee6e9d45 100644 --- a/docs/apps/incubator/tdarr-node/CHANGELOG.md +++ b/docs/apps/incubator/tdarr-node/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tdarr-node-1.0.30](https://github.com/truecharts/apps/compare/tdarr-node-1.0.29...tdarr-node-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tdarr-node-1.0.29](https://github.com/truecharts/apps/compare/tdarr-node-1.0.28...tdarr-node-1.0.29) (2021-12-19) diff --git a/docs/apps/incubator/tdarr-node/index.md b/docs/apps/incubator/tdarr-node/index.md index d86984d12c8..7def8761cce 100644 --- a/docs/apps/incubator/tdarr-node/index.md +++ b/docs/apps/incubator/tdarr-node/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/incubator/tdarr-node/security.md b/docs/apps/incubator/tdarr-node/security.md index 4509d83bb26..44a18037fe0 100644 --- a/docs/apps/incubator/tdarr-node/security.md +++ b/docs/apps/incubator/tdarr-node/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr-node' of Deployment 'RELEASE-NAME-tdarr-node' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/incubator/tdarr/CHANGELOG.md b/docs/apps/incubator/tdarr/CHANGELOG.md index d7ef2fe5c38..6971dd539b0 100644 --- a/docs/apps/incubator/tdarr/CHANGELOG.md +++ b/docs/apps/incubator/tdarr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tdarr-1.0.30](https://github.com/truecharts/apps/compare/tdarr-node-1.0.29...tdarr-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tdarr-1.0.29](https://github.com/truecharts/apps/compare/tdarr-node-1.0.28...tdarr-1.0.29) (2021-12-19) diff --git a/docs/apps/incubator/tdarr/index.md b/docs/apps/incubator/tdarr/index.md index e8508cc144a..2cd4a27130e 100644 --- a/docs/apps/incubator/tdarr/index.md +++ b/docs/apps/incubator/tdarr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/incubator/tdarr/security.md b/docs/apps/incubator/tdarr/security.md index 131dece3b51..3a08ab3f0dd 100644 --- a/docs/apps/incubator/tdarr/security.md +++ b/docs/apps/incubator/tdarr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tdarr' of Deployment 'RELEASE-NAME-tdarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/airsonic/CHANGELOG.md b/docs/apps/stable/airsonic/CHANGELOG.md index aee2535adb4..0144691574d 100644 --- a/docs/apps/stable/airsonic/CHANGELOG.md +++ b/docs/apps/stable/airsonic/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [airsonic-4.0.28](https://github.com/truecharts/apps/compare/airsonic-4.0.27...airsonic-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [airsonic-4.0.27](https://github.com/truecharts/apps/compare/airsonic-4.0.26...airsonic-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/airsonic/index.md b/docs/apps/stable/airsonic/index.md index 12ac7cf642b..b00ab32e25c 100644 --- a/docs/apps/stable/airsonic/index.md +++ b/docs/apps/stable/airsonic/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/airsonic/security.md b/docs/apps/stable/airsonic/security.md index 7b30023aea5..e32b90639ba 100644 --- a/docs/apps/stable/airsonic/security.md +++ b/docs/apps/stable/airsonic/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-airsonic' of Deployment 'RELEASE-NAME-airsonic' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/amcrest2mqtt/CHANGELOG.md b/docs/apps/stable/amcrest2mqtt/CHANGELOG.md index ca674c84c14..9577838e512 100644 --- a/docs/apps/stable/amcrest2mqtt/CHANGELOG.md +++ b/docs/apps/stable/amcrest2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [amcrest2mqtt-2.0.28](https://github.com/truecharts/apps/compare/amcrest2mqtt-2.0.27...amcrest2mqtt-2.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [amcrest2mqtt-2.0.27](https://github.com/truecharts/apps/compare/amcrest2mqtt-2.0.26...amcrest2mqtt-2.0.27) (2021-12-19) diff --git a/docs/apps/stable/amcrest2mqtt/index.md b/docs/apps/stable/amcrest2mqtt/index.md index 443025825ba..a1e34d2bcc7 100644 --- a/docs/apps/stable/amcrest2mqtt/index.md +++ b/docs/apps/stable/amcrest2mqtt/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/amcrest2mqtt/security.md b/docs/apps/stable/amcrest2mqtt/security.md index 58377914544..3c570d775da 100644 --- a/docs/apps/stable/amcrest2mqtt/security.md +++ b/docs/apps/stable/amcrest2mqtt/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-amcrest2mqtt' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-amcrest2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/anonaddy/CHANGELOG.md b/docs/apps/stable/anonaddy/CHANGELOG.md index 69fce825f82..bc456cad70d 100644 --- a/docs/apps/stable/anonaddy/CHANGELOG.md +++ b/docs/apps/stable/anonaddy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [anonaddy-6.0.18](https://github.com/truecharts/apps/compare/anonaddy-6.0.17...anonaddy-6.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [anonaddy-6.0.17](https://github.com/truecharts/apps/compare/anonaddy-6.0.16...anonaddy-6.0.17) (2021-12-19) diff --git a/docs/apps/stable/anonaddy/index.md b/docs/apps/stable/anonaddy/index.md index 0cd02399042..0d138b941be 100644 --- a/docs/apps/stable/anonaddy/index.md +++ b/docs/apps/stable/anonaddy/index.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/anonaddy/security.md b/docs/apps/stable/anonaddy/security.md index e1eda9157b3..5327323aee0 100644 --- a/docs/apps/stable/anonaddy/security.md +++ b/docs/apps/stable/anonaddy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,12 +46,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-anonaddy' of Deployment 'RELEASE-NAME-anonaddy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -73,9 +61,9 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/anonaddy:v0.8.9@sha256:7e6295239394c21d94fa370d6a1fbab5b35fd06026f47ba8a35a9d367d763254 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -180,7 +168,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** @@ -382,7 +370,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/apache-musicindex/CHANGELOG.md b/docs/apps/stable/apache-musicindex/CHANGELOG.md index 935ae3a93b6..64b21ad7452 100644 --- a/docs/apps/stable/apache-musicindex/CHANGELOG.md +++ b/docs/apps/stable/apache-musicindex/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [apache-musicindex-2.0.26](https://github.com/truecharts/apps/compare/apache-musicindex-2.0.25...apache-musicindex-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [apache-musicindex-2.0.25](https://github.com/truecharts/apps/compare/apache-musicindex-2.0.24...apache-musicindex-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/apache-musicindex/index.md b/docs/apps/stable/apache-musicindex/index.md index 52fa7ba7192..47125b74f87 100644 --- a/docs/apps/stable/apache-musicindex/index.md +++ b/docs/apps/stable/apache-musicindex/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/apache-musicindex/security.md b/docs/apps/stable/apache-musicindex/security.md index c0040484365..4ea215b8617 100644 --- a/docs/apps/stable/apache-musicindex/security.md +++ b/docs/apps/stable/apache-musicindex/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-apache-musicindex' of Deployment 'RELEASE-NAME-apache-musicindex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -88,24 +84,32 @@ hide: | apache2 | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2 | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2 | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-bin | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-bin | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-bin | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-data | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-data | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-data | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | apache2-utils | CVE-2021-33193 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-34798 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-36160 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| | apache2-utils | CVE-2021-39275 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39275
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-39275
https://linux.oracle.com/cve/CVE-2021-39275.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
| | apache2-utils | CVE-2021-40438 | MEDIUM | 2.4.41-4ubuntu3.3 | 2.4.41-4ubuntu3.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.41-4ubuntu3.3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| | curl | CVE-2021-22924 | MEDIUM | 7.68.0-1ubuntu2.5 | 7.68.0-1ubuntu2.6 |
Expand...https://curl.se/docs/CVE-2021-22924.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924
https://hackerone.com/reports/1223565
https://linux.oracle.com/cve/CVE-2021-22924.html
https://linux.oracle.com/errata/ELSA-2021-3582.html
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
https://security.netapp.com/advisory/ntap-20210902-0003/
https://ubuntu.com/security/notices/USN-5021-1
https://www.oracle.com/security-alerts/cpuoct2021.html
| @@ -281,4 +285,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/appdaemon/CHANGELOG.md b/docs/apps/stable/appdaemon/CHANGELOG.md index d608e8cfda6..1cb65541ef9 100644 --- a/docs/apps/stable/appdaemon/CHANGELOG.md +++ b/docs/apps/stable/appdaemon/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [appdaemon-7.0.7](https://github.com/truecharts/apps/compare/appdaemon-7.0.6...appdaemon-7.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [appdaemon-7.0.6](https://github.com/truecharts/apps/compare/appdaemon-7.0.5...appdaemon-7.0.6) (2021-12-19) diff --git a/docs/apps/stable/appdaemon/index.md b/docs/apps/stable/appdaemon/index.md index 136a7db9dbd..24097bb3120 100644 --- a/docs/apps/stable/appdaemon/index.md +++ b/docs/apps/stable/appdaemon/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/appdaemon/security.md b/docs/apps/stable/appdaemon/security.md index 2dea711c709..f23929d7c40 100644 --- a/docs/apps/stable/appdaemon/security.md +++ b/docs/apps/stable/appdaemon/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-appdaemon' of Deployment 'RELEASE-NAME-appdaemon' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/aria2/CHANGELOG.md b/docs/apps/stable/aria2/CHANGELOG.md index 4d1df81ab80..c8b7036efcf 100644 --- a/docs/apps/stable/aria2/CHANGELOG.md +++ b/docs/apps/stable/aria2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [aria2-3.0.7](https://github.com/truecharts/apps/compare/aria2-3.0.6...aria2-3.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [aria2-3.0.6](https://github.com/truecharts/apps/compare/aria2-3.0.5...aria2-3.0.6) (2021-12-19) diff --git a/docs/apps/stable/aria2/index.md b/docs/apps/stable/aria2/index.md index bc98ee1c7f0..d1da70e551d 100644 --- a/docs/apps/stable/aria2/index.md +++ b/docs/apps/stable/aria2/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/aria2/security.md b/docs/apps/stable/aria2/security.md index dc8bfa4abb8..403b6c48963 100644 --- a/docs/apps/stable/aria2/security.md +++ b/docs/apps/stable/aria2/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-aria2' of Deployment 'RELEASE-NAME-aria2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/audacity/CHANGELOG.md b/docs/apps/stable/audacity/CHANGELOG.md index eaeaad40d33..7f2fdc592f2 100644 --- a/docs/apps/stable/audacity/CHANGELOG.md +++ b/docs/apps/stable/audacity/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [audacity-2.0.26](https://github.com/truecharts/apps/compare/audacity-2.0.25...audacity-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [audacity-2.0.25](https://github.com/truecharts/apps/compare/audacity-2.0.24...audacity-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/audacity/index.md b/docs/apps/stable/audacity/index.md index f7d0596cb3f..1d28cd7bb89 100644 --- a/docs/apps/stable/audacity/index.md +++ b/docs/apps/stable/audacity/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/audacity/security.md b/docs/apps/stable/audacity/security.md index 7693da94044..734643225aa 100644 --- a/docs/apps/stable/audacity/security.md +++ b/docs/apps/stable/audacity/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-audacity' of Deployment 'RELEASE-NAME-audacity' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/authelia/CHANGELOG.md b/docs/apps/stable/authelia/CHANGELOG.md index 67b2548dc8b..0513f2af7d3 100644 --- a/docs/apps/stable/authelia/CHANGELOG.md +++ b/docs/apps/stable/authelia/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [authelia-8.0.21](https://github.com/truecharts/apps/compare/authelia-8.0.20...authelia-8.0.21) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [authelia-8.0.20](https://github.com/truecharts/apps/compare/authelia-8.0.19...authelia-8.0.20) (2021-12-19) diff --git a/docs/apps/stable/authelia/index.md b/docs/apps/stable/authelia/index.md index 5efa29ccb2d..451ce576a27 100644 --- a/docs/apps/stable/authelia/index.md +++ b/docs/apps/stable/authelia/index.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org/ | redis | 1.0.39 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org/ | redis | 1.0.42 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/authelia/security.md b/docs/apps/stable/authelia/security.md index a277812d6f7..7f5722c2da0 100644 --- a/docs/apps/stable/authelia/security.md +++ b/docs/apps/stable/authelia/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,32 +47,27 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-authelia' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-authelia' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-authelia' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/authelia:v4.33.1@sha256:e4c82afea63b9f9985fb597a75ebc637ee6cbc7a78d92de53829f8aa4bed4178 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -117,7 +104,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -385,7 +372,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -633,7 +620,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/babybuddy/CHANGELOG.md b/docs/apps/stable/babybuddy/CHANGELOG.md index 37c6285c718..475a3412f21 100644 --- a/docs/apps/stable/babybuddy/CHANGELOG.md +++ b/docs/apps/stable/babybuddy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [babybuddy-5.0.23](https://github.com/truecharts/apps/compare/babybuddy-5.0.22...babybuddy-5.0.23) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [babybuddy-5.0.22](https://github.com/truecharts/apps/compare/babybuddy-5.0.21...babybuddy-5.0.22) (2021-12-20) diff --git a/docs/apps/stable/babybuddy/index.md b/docs/apps/stable/babybuddy/index.md index 24889e69f13..40e08dfed91 100644 --- a/docs/apps/stable/babybuddy/index.md +++ b/docs/apps/stable/babybuddy/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/babybuddy/security.md b/docs/apps/stable/babybuddy/security.md index 19fb55232e6..a6ec37f8bf8 100644 --- a/docs/apps/stable/babybuddy/security.md +++ b/docs/apps/stable/babybuddy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,14 +36,8 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-babybuddy' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-babybuddy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/babybuddy:v1.9.3@sha256:254668977f7efbf6e631b3a5155744a7ce194075b7336ad0f136e5d5e4de3077 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -368,7 +358,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/bazarr/CHANGELOG.md b/docs/apps/stable/bazarr/CHANGELOG.md index 198427e5c52..f6694d6df8f 100644 --- a/docs/apps/stable/bazarr/CHANGELOG.md +++ b/docs/apps/stable/bazarr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [bazarr-9.0.29](https://github.com/truecharts/apps/compare/bazarr-9.0.28...bazarr-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [bazarr-9.0.28](https://github.com/truecharts/apps/compare/bazarr-9.0.27...bazarr-9.0.28) (2021-12-20) diff --git a/docs/apps/stable/bazarr/index.md b/docs/apps/stable/bazarr/index.md index 25981fdd49e..34f7b9a8fd0 100644 --- a/docs/apps/stable/bazarr/index.md +++ b/docs/apps/stable/bazarr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/bazarr/security.md b/docs/apps/stable/bazarr/security.md index 3caa9dbd9f3..4fe5e860f87 100644 --- a/docs/apps/stable/bazarr/security.md +++ b/docs/apps/stable/bazarr/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bazarr' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bazarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-bazarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -742,4 +739,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/beets/CHANGELOG.md b/docs/apps/stable/beets/CHANGELOG.md index 22927249a75..0a0917cec23 100644 --- a/docs/apps/stable/beets/CHANGELOG.md +++ b/docs/apps/stable/beets/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [beets-2.0.29](https://github.com/truecharts/apps/compare/beets-2.0.28...beets-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [beets-2.0.28](https://github.com/truecharts/apps/compare/beets-2.0.27...beets-2.0.28) (2021-12-19) diff --git a/docs/apps/stable/beets/index.md b/docs/apps/stable/beets/index.md index 8b93eae9b6b..3b8a5b42f2c 100644 --- a/docs/apps/stable/beets/index.md +++ b/docs/apps/stable/beets/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/beets/security.md b/docs/apps/stable/beets/security.md index 80266d8553d..1a97e05538d 100644 --- a/docs/apps/stable/beets/security.md +++ b/docs/apps/stable/beets/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-beets' of Deployment 'RELEASE-NAME-beets' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/blog/CHANGELOG.md b/docs/apps/stable/blog/CHANGELOG.md index 023a70e56a9..ad49651a2dc 100644 --- a/docs/apps/stable/blog/CHANGELOG.md +++ b/docs/apps/stable/blog/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [blog-0.0.16](https://github.com/truecharts/apps/compare/blog-0.0.15...blog-0.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [blog-0.0.15](https://github.com/truecharts/apps/compare/blog-0.0.14...blog-0.0.15) (2021-12-19) diff --git a/docs/apps/stable/blog/index.md b/docs/apps/stable/blog/index.md index 0caf50db065..77abdb2d459 100644 --- a/docs/apps/stable/blog/index.md +++ b/docs/apps/stable/blog/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/blog/security.md b/docs/apps/stable/blog/security.md index 02b0f45a56a..94e738a8ccf 100644 --- a/docs/apps/stable/blog/security.md +++ b/docs/apps/stable/blog/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-blog' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-blog' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/blog:latest@sha256:8f8164929c47c071024cabf591fbaea4f468dcddf3c276c3114d754c9e24dc47 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -325,6 +315,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -333,6 +325,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -341,6 +335,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -349,6 +345,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -583,7 +581,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -595,7 +593,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -605,15 +603,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -656,7 +656,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -714,7 +718,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/boinc/CHANGELOG.md b/docs/apps/stable/boinc/CHANGELOG.md index b5561527e59..6f4be36ad6b 100644 --- a/docs/apps/stable/boinc/CHANGELOG.md +++ b/docs/apps/stable/boinc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [boinc-0.0.7](https://github.com/truecharts/apps/compare/boinc-0.0.6...boinc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [boinc-0.0.6](https://github.com/truecharts/apps/compare/boinc-0.0.5...boinc-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/boinc/index.md b/docs/apps/stable/boinc/index.md index 2a2a4ad1352..7c980d56336 100644 --- a/docs/apps/stable/boinc/index.md +++ b/docs/apps/stable/boinc/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/boinc/security.md b/docs/apps/stable/boinc/security.md index 8ecaeb6218a..24e058efcbd 100644 --- a/docs/apps/stable/boinc/security.md +++ b/docs/apps/stable/boinc/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-boinc' of Deployment 'RELEASE-NAME-boinc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -310,3 +307,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/booksonic-air/CHANGELOG.md b/docs/apps/stable/booksonic-air/CHANGELOG.md index d7611377db0..a8c980a3e82 100644 --- a/docs/apps/stable/booksonic-air/CHANGELOG.md +++ b/docs/apps/stable/booksonic-air/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [booksonic-air-4.0.28](https://github.com/truecharts/apps/compare/booksonic-air-4.0.27...booksonic-air-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [booksonic-air-4.0.27](https://github.com/truecharts/apps/compare/booksonic-air-4.0.26...booksonic-air-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/booksonic-air/index.md b/docs/apps/stable/booksonic-air/index.md index 08ec43af139..2a6b41c4051 100644 --- a/docs/apps/stable/booksonic-air/index.md +++ b/docs/apps/stable/booksonic-air/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/booksonic-air/security.md b/docs/apps/stable/booksonic-air/security.md index 9b918a720f1..436c6a3e774 100644 --- a/docs/apps/stable/booksonic-air/security.md +++ b/docs/apps/stable/booksonic-air/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-booksonic-air' of Deployment 'RELEASE-NAME-booksonic-air' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -728,8 +724,8 @@ hide: | org.apache.ant:ant | CVE-2021-36374 | MEDIUM | 1.10.5 | 1.9.16, 1.10.11 |
Expand...https://ant.apache.org/security.html
https://github.com/advisories/GHSA-5v34-g2px-j4fw
https://lists.apache.org/thread.html/r27919fd4db07c487239c1d9771f480d89ce5ee2750aa9447309b709a@%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/r544c9e8487431768465b8b2d13982c75123109bd816acf839d46010d@%3Ccommits.groovy.apache.org%3E
https://lists.apache.org/thread.html/rad36f470647c5a7c02dd78c9973356d2840766d132b597b6444e373a@%3Cnotifications.groovy.apache.org%3E
https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/rf4bb79751a02889623195715925e4fd8932dd3c97e0ade91395a96c6@%3Cdev.myfaces.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-36374
https://security.netapp.com/advisory/ntap-20210819-0007/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.12 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.13.2 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.2 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.13.2 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.13.2 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.2 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 9.0.37 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 9.0.37 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25329 | HIGH | 9.0.37 | 7.0.108, 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/2
https://github.com/advisories/GHSA-jgwr-3qm3-26f3
https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25329
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/docs/apps/stable/bookstack/CHANGELOG.md b/docs/apps/stable/bookstack/CHANGELOG.md index c4c62c5c30f..4e7fb246dfb 100644 --- a/docs/apps/stable/bookstack/CHANGELOG.md +++ b/docs/apps/stable/bookstack/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [bookstack-0.0.16](https://github.com/truecharts/apps/compare/bookstack-0.0.15...bookstack-0.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [bookstack-0.0.15](https://github.com/truecharts/apps/compare/bookstack-0.0.14...bookstack-0.0.15) (2021-12-19) diff --git a/docs/apps/stable/bookstack/index.md b/docs/apps/stable/bookstack/index.md index 276f2a3dad3..8b1660edbf7 100644 --- a/docs/apps/stable/bookstack/index.md +++ b/docs/apps/stable/bookstack/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/bookstack/security.md b/docs/apps/stable/bookstack/security.md index c6cf255e2ca..9f1ccf21160 100644 --- a/docs/apps/stable/bookstack/security.md +++ b/docs/apps/stable/bookstack/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-bookstack' of Deployment 'RELEASE-NAME-bookstack' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/bookstack:v21.11.20211118@sha256:f56ca2e8e3a74e5753700e5835c017264a1ca9b1a9a6740d25a50a003815149e tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,7 +93,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.70.2 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.70.2 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.3.10 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| @@ -137,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/calibre-web/CHANGELOG.md b/docs/apps/stable/calibre-web/CHANGELOG.md index 4b153b6bcc7..b83f917b1f5 100644 --- a/docs/apps/stable/calibre-web/CHANGELOG.md +++ b/docs/apps/stable/calibre-web/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [calibre-web-9.0.26](https://github.com/truecharts/apps/compare/calibre-web-9.0.25...calibre-web-9.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [calibre-web-9.0.25](https://github.com/truecharts/apps/compare/calibre-web-9.0.24...calibre-web-9.0.25) (2021-12-19) diff --git a/docs/apps/stable/calibre-web/index.md b/docs/apps/stable/calibre-web/index.md index 632c520e09d..55c5f3f5cae 100644 --- a/docs/apps/stable/calibre-web/index.md +++ b/docs/apps/stable/calibre-web/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/calibre-web/security.md b/docs/apps/stable/calibre-web/security.md index 1574ec0ed2a..62e5ed05d0d 100644 --- a/docs/apps/stable/calibre-web/security.md +++ b/docs/apps/stable/calibre-web/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre-web' of Deployment 'RELEASE-NAME-calibre-web' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/calibre/CHANGELOG.md b/docs/apps/stable/calibre/CHANGELOG.md index ae0ccc4cc5b..da93e83acef 100644 --- a/docs/apps/stable/calibre/CHANGELOG.md +++ b/docs/apps/stable/calibre/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [calibre-5.0.7](https://github.com/truecharts/apps/compare/calibre-5.0.6...calibre-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [calibre-5.0.6](https://github.com/truecharts/apps/compare/calibre-5.0.5...calibre-5.0.6) (2021-12-19) diff --git a/docs/apps/stable/calibre/index.md b/docs/apps/stable/calibre/index.md index 3c26adc957d..d1617be265f 100644 --- a/docs/apps/stable/calibre/index.md +++ b/docs/apps/stable/calibre/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/calibre/security.md b/docs/apps/stable/calibre/security.md index db8cc4f1d47..008d35eec2b 100644 --- a/docs/apps/stable/calibre/security.md +++ b/docs/apps/stable/calibre/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-calibre' of Deployment 'RELEASE-NAME-calibre' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -331,3 +327,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/chevereto/CHANGELOG.md b/docs/apps/stable/chevereto/CHANGELOG.md index a7dbb39fb4b..bb6efa1915d 100644 --- a/docs/apps/stable/chevereto/CHANGELOG.md +++ b/docs/apps/stable/chevereto/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [chevereto-0.0.8](https://github.com/truecharts/apps/compare/chevereto-0.0.7...chevereto-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [chevereto-0.0.7](https://github.com/truecharts/apps/compare/chevereto-0.0.6...chevereto-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/chevereto/index.md b/docs/apps/stable/chevereto/index.md index 5b5b7f26c16..2605c704170 100644 --- a/docs/apps/stable/chevereto/index.md +++ b/docs/apps/stable/chevereto/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/chevereto/security.md b/docs/apps/stable/chevereto/security.md index 238b8dddf9c..633df70a786 100644 --- a/docs/apps/stable/chevereto/security.md +++ b/docs/apps/stable/chevereto/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-chevereto' of Deployment 'RELEASE-NAME-chevereto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/chevereto:v1.6.0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -136,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/clarkson/CHANGELOG.md b/docs/apps/stable/clarkson/CHANGELOG.md index 75e2a817590..af335b72f22 100644 --- a/docs/apps/stable/clarkson/CHANGELOG.md +++ b/docs/apps/stable/clarkson/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [clarkson-0.0.17](https://github.com/truecharts/apps/compare/clarkson-0.0.16...clarkson-0.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [clarkson-0.0.16](https://github.com/truecharts/apps/compare/clarkson-0.0.15...clarkson-0.0.16) (2021-12-19) diff --git a/docs/apps/stable/clarkson/index.md b/docs/apps/stable/clarkson/index.md index c04c8c3421c..45d06b63168 100644 --- a/docs/apps/stable/clarkson/index.md +++ b/docs/apps/stable/clarkson/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/clarkson/security.md b/docs/apps/stable/clarkson/security.md index c00d6dd52db..a0f0b28a999 100644 --- a/docs/apps/stable/clarkson/security.md +++ b/docs/apps/stable/clarkson/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-clarkson' of Deployment 'RELEASE-NAME-clarkson' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/clarkson:v1.1.2@sha256:a562de3138ee6e85f078f711b52ff8b376aefb7a35ab020bc4ed8f393cf7838a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -145,7 +137,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/cloud9/CHANGELOG.md b/docs/apps/stable/cloud9/CHANGELOG.md index 60cff7291b1..bfde8cfeea1 100644 --- a/docs/apps/stable/cloud9/CHANGELOG.md +++ b/docs/apps/stable/cloud9/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [cloud9-2.0.29](https://github.com/truecharts/apps/compare/cloud9-2.0.28...cloud9-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [cloud9-2.0.28](https://github.com/truecharts/apps/compare/cloud9-2.0.27...cloud9-2.0.28) (2021-12-19) diff --git a/docs/apps/stable/cloud9/index.md b/docs/apps/stable/cloud9/index.md index 4bc97a6c907..0d0605eaccc 100644 --- a/docs/apps/stable/cloud9/index.md +++ b/docs/apps/stable/cloud9/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/cloud9/security.md b/docs/apps/stable/cloud9/security.md index 23f0159d386..71b27d9c7df 100644 --- a/docs/apps/stable/cloud9/security.md +++ b/docs/apps/stable/cloud9/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cloud9' of Deployment 'RELEASE-NAME-cloud9' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -340,3 +336,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/code-server/CHANGELOG.md b/docs/apps/stable/code-server/CHANGELOG.md index 5acb7fc4a3e..9c9362a287e 100644 --- a/docs/apps/stable/code-server/CHANGELOG.md +++ b/docs/apps/stable/code-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [code-server-2.1.9](https://github.com/truecharts/apps/compare/code-server-2.1.8...code-server-2.1.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [code-server-2.1.8](https://github.com/truecharts/apps/compare/code-server-2.1.7...code-server-2.1.8) (2021-12-19) diff --git a/docs/apps/stable/code-server/index.md b/docs/apps/stable/code-server/index.md index 697554504ab..bd5c82dcfa9 100644 --- a/docs/apps/stable/code-server/index.md +++ b/docs/apps/stable/code-server/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/code-server/security.md b/docs/apps/stable/code-server/security.md index 82db0714044..6ef67256fa1 100644 --- a/docs/apps/stable/code-server/security.md +++ b/docs/apps/stable/code-server/security.md @@ -20,16 +20,13 @@ hide: | Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM |
Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.allowPrivilegeEscalation' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv001
| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-code-server' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-code-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-code-server' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -255,6 +252,7 @@ hide: | vim-common | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | vim-common | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | vim-common | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| vim-common | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| | vim-tiny | CVE-2021-3770 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3770
https://github.com/vim/vim/commit/2ddb89f8a94425cda1e5491efc80c1ccccb6e08e
https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2CJLY3CF55I2ULG2X4ENXLSXAXYW5J4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4FFQARG3LGREPDZRI4C7ERQL3RJKEWQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNTMVZCN4TRTTCAXRLVQ7H2P7FYAIZQ/
https://ubuntu.com/security/notices/USN-5093-1
| | vim-tiny | CVE-2021-3778 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3778
https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f
https://huntr.dev/bounties/d9c17308-2c99-4f9f-a706-f7f72c24c273
https://linux.oracle.com/cve/CVE-2021-3778.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| | vim-tiny | CVE-2021-3796 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3796
https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3
https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d
https://linux.oracle.com/cve/CVE-2021-3796.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| @@ -270,6 +268,7 @@ hide: | vim-tiny | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | vim-tiny | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | vim-tiny | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| vim-tiny | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| | xxd | CVE-2021-3770 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3770
https://github.com/vim/vim/commit/2ddb89f8a94425cda1e5491efc80c1ccccb6e08e
https://github.com/vim/vim/commit/b7081e135a16091c93f6f5f7525a5c58fb7ca9f9
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365
https://huntr.dev/bounties/016ad2f2-07c1-4d14-a8ce-6eed10729365/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2CJLY3CF55I2ULG2X4ENXLSXAXYW5J4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X4FFQARG3LGREPDZRI4C7ERQL3RJKEWQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFNTMVZCN4TRTTCAXRLVQ7H2P7FYAIZQ/
https://ubuntu.com/security/notices/USN-5093-1
| | xxd | CVE-2021-3778 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3778
https://github.com/vim/vim/commit/65b605665997fad54ef39a93199e305af2fe4d7f
https://huntr.dev/bounties/d9c17308-2c99-4f9f-a706-f7f72c24c273
https://linux.oracle.com/cve/CVE-2021-3778.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| | xxd | CVE-2021-3796 | HIGH | 2:8.2.2434-3 | 2:8.2.2434-3+deb11u1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/01/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3796
https://github.com/vim/vim/commit/35a9a00afcb20897d462a766793ff45534810dc3
https://huntr.dev/bounties/ab60b7f3-6fb1-4ac2-a4fa-4d592e08008d
https://linux.oracle.com/cve/CVE-2021-3796.html
https://linux.oracle.com/errata/ELSA-2021-4517.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7K4JJBIH3OQSZRVTWKCJCDLGMFGQ5DOH/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S42L4Z4DTW4LHLQ4FJ33VEOXRCBE7WN4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TE62UMYBZE4AE53K6OBBWK32XQ7544QM/
https://ubuntu.com/security/notices/USN-5093-1
| @@ -285,6 +284,7 @@ hide: | xxd | CVE-2021-4069 | HIGH | 2:8.2.2434-3 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4069
https://github.com/vim/vim/commit/e031fe90cf2e375ce861ff5e5e281e4ad229ebb9
https://huntr.dev/bounties/0efd6d23-2259-4081-9ff1-3ade26907d74
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WYB2LLNUFJUKJJ5HYCZ6MV3Z6YX3U5BN/
| | xxd | CVE-2008-4677 | LOW | 2:8.2.2434-3 | |
Expand...http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/31464
http://secunia.com/advisories/34418
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
| | xxd | CVE-2017-1000382 | LOW | 2:8.2.2434-3 | |
Expand...http://security.cucumberlinux.com/security/details.php?id=120
http://www.openwall.com/lists/oss-security/2017/10/31/1
| +| xxd | CVE-2021-4136 | UNKNOWN | 2:8.2.2434-3 | |
Expand...https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264
https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
| **gobinary** @@ -292,13 +292,12 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20191206172530-e9b2fee46413 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20191206172530-e9b2fee46413 | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.1 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.1 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| | gopkg.in/yaml.v2 | GMS-2019-2 | UNKNOWN | v2.2.1 | v2.2.3 |
Expand...https://github.com/docker/cli/pull/2117
| -| gopkg.in/yaml.v2 | GO-2021-0061 | UNKNOWN | v2.2.1 | v2.2.3 |
Expand...
| +| gopkg.in/yaml.v2 | GO-2021-0061 | UNKNOWN | v2.2.1 | 2.2.3 |
Expand...
| diff --git a/docs/apps/stable/collabora-online/CHANGELOG.md b/docs/apps/stable/collabora-online/CHANGELOG.md index d655df75171..e6fa29750c8 100644 --- a/docs/apps/stable/collabora-online/CHANGELOG.md +++ b/docs/apps/stable/collabora-online/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [collabora-online-10.0.7](https://github.com/truecharts/apps/compare/collabora-online-10.0.6...collabora-online-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [collabora-online-10.0.6](https://github.com/truecharts/apps/compare/collabora-online-10.0.5...collabora-online-10.0.6) (2021-12-19) diff --git a/docs/apps/stable/collabora-online/index.md b/docs/apps/stable/collabora-online/index.md index 0472428fd73..5fc7a214782 100644 --- a/docs/apps/stable/collabora-online/index.md +++ b/docs/apps/stable/collabora-online/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/collabora-online/security.md b/docs/apps/stable/collabora-online/security.md index 12d017e0bd9..914d816f100 100644 --- a/docs/apps/stable/collabora-online/security.md +++ b/docs/apps/stable/collabora-online/security.md @@ -21,12 +21,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-collabora-online' of Deployment 'RELEASE-NAME-collabora-online' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/couchpotato/CHANGELOG.md b/docs/apps/stable/couchpotato/CHANGELOG.md index 1237f32a857..4b47a25879f 100644 --- a/docs/apps/stable/couchpotato/CHANGELOG.md +++ b/docs/apps/stable/couchpotato/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [couchpotato-0.0.7](https://github.com/truecharts/apps/compare/couchpotato-0.0.6...couchpotato-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [couchpotato-0.0.6](https://github.com/truecharts/apps/compare/couchpotato-0.0.5...couchpotato-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/couchpotato/index.md b/docs/apps/stable/couchpotato/index.md index ba3edd49bab..aa4bd53e248 100644 --- a/docs/apps/stable/couchpotato/index.md +++ b/docs/apps/stable/couchpotato/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/couchpotato/security.md b/docs/apps/stable/couchpotato/security.md index 6847214e153..e1d2f9ff42f 100644 --- a/docs/apps/stable/couchpotato/security.md +++ b/docs/apps/stable/couchpotato/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-couchpotato' of Deployment 'RELEASE-NAME-couchpotato' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/cryptofolio/CHANGELOG.md b/docs/apps/stable/cryptofolio/CHANGELOG.md index 65cdbf36766..f14bfc99881 100644 --- a/docs/apps/stable/cryptofolio/CHANGELOG.md +++ b/docs/apps/stable/cryptofolio/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [cryptofolio-2.0.26](https://github.com/truecharts/apps/compare/cryptofolio-2.0.25...cryptofolio-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [cryptofolio-2.0.25](https://github.com/truecharts/apps/compare/cryptofolio-2.0.24...cryptofolio-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/cryptofolio/index.md b/docs/apps/stable/cryptofolio/index.md index be04f1e664b..4078490dc95 100644 --- a/docs/apps/stable/cryptofolio/index.md +++ b/docs/apps/stable/cryptofolio/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/cryptofolio/security.md b/docs/apps/stable/cryptofolio/security.md index ed2c9a28791..09a71f45f9a 100644 --- a/docs/apps/stable/cryptofolio/security.md +++ b/docs/apps/stable/cryptofolio/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-cryptofolio' of Deployment 'RELEASE-NAME-cryptofolio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,6 +82,8 @@ hide: | apache2 | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -98,6 +96,8 @@ hide: | apache2-bin | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -110,6 +110,8 @@ hide: | apache2-data | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -122,6 +124,8 @@ hide: | apache2-utils | CVE-2021-40438 | CRITICAL | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-40438
https://linux.oracle.com/cve/CVE-2021-40438.html
https://linux.oracle.com/errata/ELSA-2021-3856.html
https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://ubuntu.com/security/notices/USN-5090-2 (regression update esm)
https://ubuntu.com/security/notices/USN-5090-3 (regression update)
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-34798 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34798
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-34798
https://linux.oracle.com/cve/CVE-2021-34798.html
https://linux.oracle.com/errata/ELSA-2021-9619.html
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://ubuntu.com/security/notices/USN-5090-2
https://www.debian.org/security/2021/dsa-4982
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2021-36160 | HIGH | 2.4.48-3.1+deb11u1 | 2.4.51-1~deb11u1 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36160
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-36160
https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r73260f6ba9fb52e43d860905fc90462ba5a814afda2d011f32bbd41c@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2746e916ed370239bc1a1025e5ebbf345f79df9ea0ea39e44acfbb@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E
https://lists.apache.org/thread.html/r94a61a1517133a19dcf40016e87454ea86e355d06a0cec4c778530f3@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra1c05a392587bfe34383dffe1213edc425de8d4afc25b7cefab3e781@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra87a69d0703d09dc52b86e32b08f8d7327af10acdd5f577a4e82596a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb2341c8786d0f9924f5b666e82d8d170b4804f50a523d750551bef1a@%3Cbugs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/09/msg00016.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00016.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.netapp.com/advisory/ntap-20211008-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.debian.org/security/2021/dsa-4982
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.48-3.1+deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.48-3.1+deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -359,7 +363,7 @@ hide: | linux-libc-dev | CVE-2021-40490 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| | linux-libc-dev | CVE-2021-41073 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...http://www.openwall.com/lists/oss-security/2021/09/18/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41073
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J7KSMIOQ4377CVTHMWNGNCWHMCRFRP2T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAP4TXEZ7J4EZQMQW5SIJMWXG7WZT3F7/
https://security.netapp.com/advisory/ntap-20211014-0003/
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://www.debian.org/security/2021/dsa-4978
https://www.openwall.com/lists/oss-security/2021/09/18/2
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-4 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -375,9 +379,9 @@ hide: | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-4 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| | linux-libc-dev | CVE-2020-3702 | MEDIUM | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/linux-wireless/CABvG-CVvPF++0vuGzCrBj8+s=Bcx1GwWfiW1_Somu_GVncTAcQ@mail.gmail.com/
https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#mf8b430d4f19f1b939a29b6c5098fdc514fd1a928
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.arista.com/en/support/advisories-notices/security-advisories/11998-security-advisory-58
https://www.debian.org/security/2021/dsa-4978
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -394,15 +398,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-4 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-4 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-4 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-4 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-4 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -448,7 +454,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-4 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| diff --git a/docs/apps/stable/custom-app/CHANGELOG.md b/docs/apps/stable/custom-app/CHANGELOG.md index 277058a0ac9..63e0b3d3a53 100644 --- a/docs/apps/stable/custom-app/CHANGELOG.md +++ b/docs/apps/stable/custom-app/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [custom-app-3.0.45](https://github.com/truecharts/apps/compare/custom-app-3.0.44...custom-app-3.0.45) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [custom-app-3.0.44](https://github.com/truecharts/apps/compare/custom-app-3.0.43...custom-app-3.0.44) (2021-12-20) diff --git a/docs/apps/stable/custom-app/helm-values.md b/docs/apps/stable/custom-app/helm-values.md index c95b9971857..614626d5c52 100644 --- a/docs/apps/stable/custom-app/helm-values.md +++ b/docs/apps/stable/custom-app/helm-values.md @@ -13,6 +13,6 @@ You will, however, be able to use all values referenced in the common chart here |-----|------|---------|-------------| | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/jackett"` | | -| image.tag | string | `"v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f"` | | +| image.tag | string | `"v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2"` | | All Rights Reserved - The TrueCharts Project diff --git a/docs/apps/stable/custom-app/index.md b/docs/apps/stable/custom-app/index.md index f77b0fddf3b..03e0d626d24 100644 --- a/docs/apps/stable/custom-app/index.md +++ b/docs/apps/stable/custom-app/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/custom-app/security.md b/docs/apps/stable/custom-app/security.md index be2b9e151ac..7190f759d18 100644 --- a/docs/apps/stable/custom-app/security.md +++ b/docs/apps/stable/custom-app/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-custom-app' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-custom-app' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-custom-app' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f + tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f (ubuntu 20.04) +#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 (ubuntu 20.04) **ubuntu** @@ -153,4 +150,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/darktable/CHANGELOG.md b/docs/apps/stable/darktable/CHANGELOG.md index d0dd82625f9..d31c11ba978 100644 --- a/docs/apps/stable/darktable/CHANGELOG.md +++ b/docs/apps/stable/darktable/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [darktable-0.0.7](https://github.com/truecharts/apps/compare/darktable-0.0.6...darktable-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [darktable-0.0.6](https://github.com/truecharts/apps/compare/darktable-0.0.5...darktable-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/darktable/index.md b/docs/apps/stable/darktable/index.md index e99ade74b34..b3a4dd986eb 100644 --- a/docs/apps/stable/darktable/index.md +++ b/docs/apps/stable/darktable/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/darktable/security.md b/docs/apps/stable/darktable/security.md index e0b135f4d51..751022b75e9 100644 --- a/docs/apps/stable/darktable/security.md +++ b/docs/apps/stable/darktable/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-darktable' of Deployment 'RELEASE-NAME-darktable' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/davos/CHANGELOG.md b/docs/apps/stable/davos/CHANGELOG.md index c82c3ae334e..7741b28f533 100644 --- a/docs/apps/stable/davos/CHANGELOG.md +++ b/docs/apps/stable/davos/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [davos-2.0.26](https://github.com/truecharts/apps/compare/davos-2.0.25...davos-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [davos-2.0.25](https://github.com/truecharts/apps/compare/davos-2.0.24...davos-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/davos/index.md b/docs/apps/stable/davos/index.md index e646caeb72d..f7c15319c4f 100644 --- a/docs/apps/stable/davos/index.md +++ b/docs/apps/stable/davos/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/davos/security.md b/docs/apps/stable/davos/security.md index 56b7d9d9396..227a5f7064b 100644 --- a/docs/apps/stable/davos/security.md +++ b/docs/apps/stable/davos/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-davos' of Deployment 'RELEASE-NAME-davos' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -139,13 +135,13 @@ hide: | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.4 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.2 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.4.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.logging.log4j:log4j-core | CVE-2017-5645 | CRITICAL | 2.4.1 | 2.8.2 |
Expand...http://www.openwall.com/lists/oss-security/2019/12/19/2
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/97702
http://www.securitytracker.com/id/1040200
http://www.securitytracker.com/id/1041294
https://access.redhat.com/errata/RHSA-2017:1417
https://access.redhat.com/errata/RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:1802
https://access.redhat.com/errata/RHSA-2017:2423
https://access.redhat.com/errata/RHSA-2017:2633
https://access.redhat.com/errata/RHSA-2017:2635
https://access.redhat.com/errata/RHSA-2017:2636
https://access.redhat.com/errata/RHSA-2017:2637
https://access.redhat.com/errata/RHSA-2017:2638
https://access.redhat.com/errata/RHSA-2017:2808
https://access.redhat.com/errata/RHSA-2017:2809
https://access.redhat.com/errata/RHSA-2017:2810
https://access.redhat.com/errata/RHSA-2017:2811
https://access.redhat.com/errata/RHSA-2017:2888
https://access.redhat.com/errata/RHSA-2017:2889
https://access.redhat.com/errata/RHSA-2017:3244
https://access.redhat.com/errata/RHSA-2017:3399
https://access.redhat.com/errata/RHSA-2017:3400
https://access.redhat.com/errata/RHSA-2019:1545
https://github.com/advisories/GHSA-fxph-q3j8-mv87
https://issues.apache.org/jira/browse/LOG4J2-1863
https://linux.oracle.com/cve/CVE-2017-5645.html
https://linux.oracle.com/errata/ELSA-2017-2423.html
https://lists.apache.org/thread.html/0dcca05274d20ef2d72584edcf8c917bbb13dbbd7eb35cae909d02e9@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/84cc4266238e057b95eb95dfd8b29d46a2592e7672c12c92f68b2917@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125@%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/r0831e2e52a390758ce39a6193f82c11c295175adce6e6307de28c287@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r23369fd603eb6d62d3b883a0a28d12052dcbd1d6d531137124cd7f83@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r94b5aae09c4bcff5d06cf641be17b00bd83ba7e10cad737bf16a1b8f@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/r9d5c1b558a15d374bd5abd2d3ae3ca7e50e796a0efdcf91e9c5b4cdd@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/ra9a682bc0a8dff1c5cefdef31c7c25f096d9121207cf2d74e2fc563d@%3Ccommits.logging.apache.org%3E
https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rbfa7a0742be4981a3f9356a23d0e1a5f2e1eabde32a1a3d8e41420f8@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rcbb79023a7c8494cb389cd3d95420fa9e0d531ece0b780b8c1f99422@%3Ccommits.doris.apache.org%3E
https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rdbd579dc223f06af826d7de340218ee2f80d8b43fa7e4decb2a63f44@%3Cgithub.beam.apache.org%3E
https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5645
https://security.netapp.com/advisory/ntap-20180726-0002/
https://security.netapp.com/advisory/ntap-20181107-0002/
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.logging.log4j:log4j-core | CVE-2021-44228 | CRITICAL | 2.4.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-core | CVE-2020-9488 | LOW | 2.4.1 | 2.13.2 |
Expand...https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45046 | LOW | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45046 | CRITICAL | 2.4.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.4.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-core | CVE-2020-9488 | LOW | 2.4.1 | 2.13.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9488
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b (release-2.x)
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=fb91a3d71e2f3dadad6fd1beb2ab857f44fe8bbb (master)
https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.openwall.com/lists/oss-security/2020/04/25/1
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2017-5648 | CRITICAL | 8.5.6 | 7.0.76, 8.0.42, 8.5.12, 9.0.1 |
Expand...http://www.debian.org/security/2017/dsa-3842
http://www.debian.org/security/2017/dsa-3843
http://www.openwall.com/lists/oss-security/2017/04/10/23
http://www.openwall.com/lists/oss-security/2020/07/20/8
http://www.securityfocus.com/bid/97530
http://www.securitytracker.com/id/1038220
https://access.redhat.com/errata/RHSA-2017:1801
https://access.redhat.com/errata/RHSA-2017:1802
https://access.redhat.com/errata/RHSA-2017:1809
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5648
https://linux.oracle.com/cve/CVE-2017-5648.html
https://linux.oracle.com/errata/ELSA-2017-1809.html
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5648
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20180614-0001/
https://ubuntu.com/security/notices/USN-3519-1
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2017-5651 | CRITICAL | 8.5.6 | 8.5.13, 9.0.1 |
Expand...http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
http://www.securityfocus.com/bid/97544
http://www.securitytracker.com/id/1038219
https://bz.apache.org/bugzilla/show_bug.cgi?id=60918
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6694538826b87522fb723d2dcedd537e14ebe0a381d92e5525a531d8@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2017-5651
https://security.gentoo.org/glsa/201705-09
https://security.netapp.com/advisory/ntap-20180614-0001/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2018-8014 | CRITICAL | 8.5.6 | 7.0.88, 8.0.53, 8.5.32, 9.0.9 |
Expand...http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
http://tomcat.apache.org/security-9.html
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
http://www.securityfocus.com/bid/104203
http://www.securitytracker.com/id/1040998
http://www.securitytracker.com/id/1041888
https://access.redhat.com/errata/RHSA-2018:2469
https://access.redhat.com/errata/RHSA-2018:2470
https://access.redhat.com/errata/RHSA-2018:3768
https://access.redhat.com/errata/RHSA-2019:0450
https://access.redhat.com/errata/RHSA-2019:0451
https://access.redhat.com/errata/RHSA-2019:1529
https://access.redhat.com/errata/RHSA-2019:2205
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8014
https://github.com/advisories/GHSA-r4x2-3cq5-hqvp
https://linux.oracle.com/cve/CVE-2018-8014.html
https://linux.oracle.com/errata/ELSA-2019-2205.html
https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
https://nvd.nist.gov/vuln/detail/CVE-2018-8014
https://seclists.org/bugtraq/2019/Dec/43
https://security.netapp.com/advisory/ntap-20181018-0002/
https://ubuntu.com/security/notices/USN-3665-1
https://usn.ubuntu.com/3665-1/
https://www.debian.org/security/2019/dsa-4596
https://www.oracle.com/security-alerts/cpuapr2020.html
| diff --git a/docs/apps/stable/ddclient/CHANGELOG.md b/docs/apps/stable/ddclient/CHANGELOG.md index 33b5daf5cdb..c5ccb9c61b8 100644 --- a/docs/apps/stable/ddclient/CHANGELOG.md +++ b/docs/apps/stable/ddclient/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ddclient-0.0.7](https://github.com/truecharts/apps/compare/ddclient-0.0.6...ddclient-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ddclient-0.0.6](https://github.com/truecharts/apps/compare/ddclient-0.0.5...ddclient-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/ddclient/index.md b/docs/apps/stable/ddclient/index.md index db1ec4122fb..12bfe4844ce 100644 --- a/docs/apps/stable/ddclient/index.md +++ b/docs/apps/stable/ddclient/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/ddclient/security.md b/docs/apps/stable/ddclient/security.md index 0976da47ab9..ef53390b360 100644 --- a/docs/apps/stable/ddclient/security.md +++ b/docs/apps/stable/ddclient/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ddclient' of Deployment 'RELEASE-NAME-ddclient' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/deconz/CHANGELOG.md b/docs/apps/stable/deconz/CHANGELOG.md index e7862750906..07ff2d25085 100644 --- a/docs/apps/stable/deconz/CHANGELOG.md +++ b/docs/apps/stable/deconz/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deconz-6.0.7](https://github.com/truecharts/apps/compare/deconz-6.0.6...deconz-6.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deconz-6.0.6](https://github.com/truecharts/apps/compare/deconz-6.0.5...deconz-6.0.6) (2021-12-19) diff --git a/docs/apps/stable/deconz/index.md b/docs/apps/stable/deconz/index.md index f047e799d79..add032eeb44 100644 --- a/docs/apps/stable/deconz/index.md +++ b/docs/apps/stable/deconz/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/deconz/security.md b/docs/apps/stable/deconz/security.md index 0e0c040a265..ad13d53eaa1 100644 --- a/docs/apps/stable/deconz/security.md +++ b/docs/apps/stable/deconz/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deconz' of Deployment 'RELEASE-NAME-deconz' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/deepstack-cpu/CHANGELOG.md b/docs/apps/stable/deepstack-cpu/CHANGELOG.md index 9b5f7b745b8..f632b0bf8e5 100644 --- a/docs/apps/stable/deepstack-cpu/CHANGELOG.md +++ b/docs/apps/stable/deepstack-cpu/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deepstack-cpu-8.0.8](https://github.com/truecharts/apps/compare/deepstack-cpu-8.0.7...deepstack-cpu-8.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deepstack-cpu-8.0.7](https://github.com/truecharts/apps/compare/deepstack-cpu-8.0.6...deepstack-cpu-8.0.7) (2021-12-19) diff --git a/docs/apps/stable/deepstack-cpu/index.md b/docs/apps/stable/deepstack-cpu/index.md index 8bf1a780989..4feb103153f 100644 --- a/docs/apps/stable/deepstack-cpu/index.md +++ b/docs/apps/stable/deepstack-cpu/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/deepstack-cpu/security.md b/docs/apps/stable/deepstack-cpu/security.md index 455cc9497c3..4614676a606 100644 --- a/docs/apps/stable/deepstack-cpu/security.md +++ b/docs/apps/stable/deepstack-cpu/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-cpu' of Deployment 'RELEASE-NAME-deepstack-cpu' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -2715,7 +2711,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-40490 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.152-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -2760,13 +2756,13 @@ hide: | linux-libc-dev | CVE-2020-4788 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...http://www.openwall.com/lists/oss-security/2020/11/20/3
http://www.openwall.com/lists/oss-security/2020/11/23/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788
https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dda3f4252e6c8b833a2ef164afd3da9808d0f07c
https://linux.oracle.com/cve/CVE-2020-4788.html
https://linux.oracle.com/errata/ELSA-2021-9308.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc
https://ubuntu.com/security/notices/USN-4657-1
https://ubuntu.com/security/notices/USN-4658-1
https://ubuntu.com/security/notices/USN-4659-1
https://ubuntu.com/security/notices/USN-4660-1
https://ubuntu.com/security/notices/USN-4681-1
https://www.ibm.com/support/pages/node/6370729
https://www.openwall.com/lists/oss-security/2020/11/20/3
| | linux-libc-dev | CVE-2020-8694 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694
https://linux.oracle.com/cve/CVE-2020-8694.html
https://linux.oracle.com/errata/ELSA-2020-5996.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
https://platypusattack.com/
https://ubuntu.com/security/notices/USN-4626-1
https://ubuntu.com/security/notices/USN-4627-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html
| | linux-libc-dev | CVE-2021-0129 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0129
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=00da0fb4972cf59e1c075f313da81ea549cb8738
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f
https://linux.oracle.com/cve/CVE-2021-0129.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
https://security.netapp.com/advisory/ntap-20210716-0002/
https://ubuntu.com/security/notices/USN-5017-1
https://ubuntu.com/security/notices/USN-5018-1
https://ubuntu.com/security/notices/USN-5046-1
https://ubuntu.com/security/notices/USN-5050-1
https://www.debian.org/security/2021/dsa-4951
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-0937 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0937
https://git.kernel.org/linus/b29c457a6511435960115c0f548c4360d5f4801d
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-0941 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://android.googlesource.com/kernel/common/+/6306c1189e77a513bf02720450bb43bd4ba5d8ae%5E%21/#F0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0941
https://git.kernel.org/6306c1189e77a513bf02720450bb43bd4ba5d8ae
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-20177 | MEDIUM | 4.19.152-1 | 4.19.171-2 |
Expand...https://bugzilla.kernel.org/show_bug.cgi?id=209823
https://bugzilla.redhat.com/show_bug.cgi?id=1914719
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20177
https://linux.oracle.com/cve/CVE-2021-20177.html
https://linux.oracle.com/errata/ELSA-2021-9038.html
https://ubuntu.com/security/notices/USN-4750-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.152-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-26931 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-362.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26931
https://linux.oracle.com/cve/CVE-2021-26931.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://ubuntu.com/security/notices/USN-4904-1
https://ubuntu.com/security/notices/USN-4909-1
https://ubuntu.com/security/notices/USN-4946-1
https://ubuntu.com/security/notices/USN-4949-1
https://www.openwall.com/lists/oss-security/2021/02/16/4
https://xenbits.xen.org/xsa/advisory-362.html
| | linux-libc-dev | CVE-2021-26932 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-361.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932
https://linux.oracle.com/cve/CVE-2021-26932.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/3
https://xenbits.xen.org/xsa/advisory-361.html
| | linux-libc-dev | CVE-2021-27363 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
http://www.openwall.com/lists/oss-security/2021/03/06/1
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
https://bugzilla.suse.com/show_bug.cgi?id=1182716
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
https://git.kernel.org/linus/688e8128b7a92df982709a4137ea4588d16f24aa
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
https://linux.oracle.com/cve/CVE-2021-27363.html
https://linux.oracle.com/errata/ELSA-2021-9175.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://security.netapp.com/advisory/ntap-20210409-0001/
https://ubuntu.com/security/notices/USN-4883-1
https://ubuntu.com/security/notices/USN-4887-1
https://ubuntu.com/security/notices/USN-4889-1
https://ubuntu.com/security/notices/USN-4901-1
https://www.openwall.com/lists/oss-security/2021/03/06/1
| @@ -2807,14 +2803,19 @@ hide: | linux-libc-dev | CVE-2021-38199 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38199
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20210902-0010/
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
https://ubuntu.com/security/notices/USN-5136-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-38208 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/08/17/1
http://www.openwall.com/lists/oss-security/2021/08/17/2
http://www.openwall.com/lists/oss-security/2021/08/24/2
https://bugzilla.redhat.com/show_bug.cgi?id=1992810
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38208
https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba
https://ubuntu.com/security/notices/USN-5050-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| +| linux-libc-dev | CVE-2021-39648 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39656 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39657 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.152-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.152-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.152-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.152-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.152-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -2873,10 +2874,11 @@ hide: | linux-libc-dev | CVE-2021-38204 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| | linux-libc-dev | CVE-2021-38209 | LOW | 4.19.152-1 | 4.19.194-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38209
https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6
| -| linux-libc-dev | CVE-2021-39648 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39656 | UNKNOWN | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39657 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.152-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -3046,5 +3048,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| diff --git a/docs/apps/stable/deepstack-gpu/CHANGELOG.md b/docs/apps/stable/deepstack-gpu/CHANGELOG.md index 37ec04e688e..e57673bf082 100644 --- a/docs/apps/stable/deepstack-gpu/CHANGELOG.md +++ b/docs/apps/stable/deepstack-gpu/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deepstack-gpu-3.0.8](https://github.com/truecharts/apps/compare/deepstack-gpu-3.0.7...deepstack-gpu-3.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deepstack-gpu-3.0.7](https://github.com/truecharts/apps/compare/deepstack-gpu-3.0.6...deepstack-gpu-3.0.7) (2021-12-19) diff --git a/docs/apps/stable/deepstack-gpu/index.md b/docs/apps/stable/deepstack-gpu/index.md index 8bf1a780989..4feb103153f 100644 --- a/docs/apps/stable/deepstack-gpu/index.md +++ b/docs/apps/stable/deepstack-gpu/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/deepstack-gpu/security.md b/docs/apps/stable/deepstack-gpu/security.md index 6f767d2c697..eeab83a9ae1 100644 --- a/docs/apps/stable/deepstack-gpu/security.md +++ b/docs/apps/stable/deepstack-gpu/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deepstack-gpu' of Deployment 'RELEASE-NAME-deepstack-gpu' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -2715,7 +2711,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-40490 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.152-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -2760,13 +2756,13 @@ hide: | linux-libc-dev | CVE-2020-4788 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...http://www.openwall.com/lists/oss-security/2020/11/20/3
http://www.openwall.com/lists/oss-security/2020/11/23/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4788
https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dda3f4252e6c8b833a2ef164afd3da9808d0f07c
https://linux.oracle.com/cve/CVE-2020-4788.html
https://linux.oracle.com/errata/ELSA-2021-9308.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
https://lore.kernel.org/linuxppc-dev/20201119231333.361771-1-dja@axtens.net/T/#me4f6a44748747e3327d27cd95200bf7a87486ffc
https://ubuntu.com/security/notices/USN-4657-1
https://ubuntu.com/security/notices/USN-4658-1
https://ubuntu.com/security/notices/USN-4659-1
https://ubuntu.com/security/notices/USN-4660-1
https://ubuntu.com/security/notices/USN-4681-1
https://www.ibm.com/support/pages/node/6370729
https://www.openwall.com/lists/oss-security/2020/11/20/3
| | linux-libc-dev | CVE-2020-8694 | MEDIUM | 4.19.152-1 | 4.19.160-1 |
Expand...https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8694
https://linux.oracle.com/cve/CVE-2020-8694.html
https://linux.oracle.com/errata/ELSA-2020-5996.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html
https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html
https://platypusattack.com/
https://ubuntu.com/security/notices/USN-4626-1
https://ubuntu.com/security/notices/USN-4627-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00389.html
| | linux-libc-dev | CVE-2021-0129 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0129
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=00da0fb4972cf59e1c075f313da81ea549cb8738
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6d19628f539fccf899298ff02ee4c73e4bf6df3f
https://linux.oracle.com/cve/CVE-2021-0129.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html
https://security.netapp.com/advisory/ntap-20210716-0002/
https://ubuntu.com/security/notices/USN-5017-1
https://ubuntu.com/security/notices/USN-5018-1
https://ubuntu.com/security/notices/USN-5046-1
https://ubuntu.com/security/notices/USN-5050-1
https://www.debian.org/security/2021/dsa-4951
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00517.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-0937 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0937
https://git.kernel.org/linus/b29c457a6511435960115c0f548c4360d5f4801d
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-0941 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...https://android.googlesource.com/kernel/common/+/6306c1189e77a513bf02720450bb43bd4ba5d8ae%5E%21/#F0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0941
https://git.kernel.org/6306c1189e77a513bf02720450bb43bd4ba5d8ae
https://source.android.com/security/bulletin/pixel/2021-10-01
| | linux-libc-dev | CVE-2021-20177 | MEDIUM | 4.19.152-1 | 4.19.171-2 |
Expand...https://bugzilla.kernel.org/show_bug.cgi?id=209823
https://bugzilla.redhat.com/show_bug.cgi?id=1914719
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20177
https://linux.oracle.com/cve/CVE-2021-20177.html
https://linux.oracle.com/errata/ELSA-2021-9038.html
https://ubuntu.com/security/notices/USN-4750-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.152-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.152-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-26931 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-362.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26931
https://linux.oracle.com/cve/CVE-2021-26931.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://ubuntu.com/security/notices/USN-4904-1
https://ubuntu.com/security/notices/USN-4909-1
https://ubuntu.com/security/notices/USN-4946-1
https://ubuntu.com/security/notices/USN-4949-1
https://www.openwall.com/lists/oss-security/2021/02/16/4
https://xenbits.xen.org/xsa/advisory-362.html
| | linux-libc-dev | CVE-2021-26932 | MEDIUM | 4.19.152-1 | 4.19.177-1 |
Expand...http://xenbits.xen.org/xsa/advisory-361.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26932
https://linux.oracle.com/cve/CVE-2021-26932.html
https://linux.oracle.com/errata/ELSA-2021-9136.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XQR52ICKRK3GC4HDWLMWF2U55YGAR63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GWQWPWYZRXVFJI5M3VCM72X27IB7CKOB/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/3
https://xenbits.xen.org/xsa/advisory-361.html
| | linux-libc-dev | CVE-2021-27363 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html
http://www.openwall.com/lists/oss-security/2021/03/06/1
https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html
https://bugzilla.suse.com/show_bug.cgi?id=1182716
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27363
https://git.kernel.org/linus/688e8128b7a92df982709a4137ea4588d16f24aa
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa
https://linux.oracle.com/cve/CVE-2021-27363.html
https://linux.oracle.com/errata/ELSA-2021-9175.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html
https://security.netapp.com/advisory/ntap-20210409-0001/
https://ubuntu.com/security/notices/USN-4883-1
https://ubuntu.com/security/notices/USN-4887-1
https://ubuntu.com/security/notices/USN-4889-1
https://ubuntu.com/security/notices/USN-4901-1
https://www.openwall.com/lists/oss-security/2021/03/06/1
| @@ -2807,14 +2803,19 @@ hide: | linux-libc-dev | CVE-2021-38199 | MEDIUM | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38199
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://github.com/torvalds/linux/commit/dd99e9f98fbf423ff6d365b37a98e8879170f17c
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20210902-0010/
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
https://ubuntu.com/security/notices/USN-5136-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-38208 | MEDIUM | 4.19.152-1 | 4.19.194-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/08/17/1
http://www.openwall.com/lists/oss-security/2021/08/17/2
http://www.openwall.com/lists/oss-security/2021/08/24/2
https://bugzilla.redhat.com/show_bug.cgi?id=1992810
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.10
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38208
https://github.com/torvalds/linux/commit/4ac06a1e013cf5fdd963317ffd3b968560f33bba
https://ubuntu.com/security/notices/USN-5050-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.152-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| +| linux-libc-dev | CVE-2021-39648 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39656 | MEDIUM | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| +| linux-libc-dev | CVE-2021-39657 | MEDIUM | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.152-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.152-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.152-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.152-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.152-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.152-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -2873,10 +2874,11 @@ hide: | linux-libc-dev | CVE-2021-38204 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 4.19.152-1 | 4.19.208-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| | linux-libc-dev | CVE-2021-38209 | LOW | 4.19.152-1 | 4.19.194-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38209
https://github.com/torvalds/linux/commit/2671fa4dc0109d3fb581bc3078fdf17b5d9080f6
| -| linux-libc-dev | CVE-2021-39648 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39656 | UNKNOWN | 4.19.152-1 | 4.19.181-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-39657 | UNKNOWN | 4.19.152-1 | 4.19.171-1 |
Expand...https://source.android.com/security/bulletin/pixel/2021-12-01
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.152-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.152-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.152-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -3046,5 +3048,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| diff --git a/docs/apps/stable/deluge/CHANGELOG.md b/docs/apps/stable/deluge/CHANGELOG.md index ab9872cc902..d0f191f4f4e 100644 --- a/docs/apps/stable/deluge/CHANGELOG.md +++ b/docs/apps/stable/deluge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [deluge-9.0.27](https://github.com/truecharts/apps/compare/deluge-9.0.26...deluge-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [deluge-9.0.26](https://github.com/truecharts/apps/compare/deluge-9.0.25...deluge-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/deluge/index.md b/docs/apps/stable/deluge/index.md index 6c9e2bf68a9..6d3b83acab8 100644 --- a/docs/apps/stable/deluge/index.md +++ b/docs/apps/stable/deluge/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/deluge/security.md b/docs/apps/stable/deluge/security.md index 1bb01b39166..805db64cc25 100644 --- a/docs/apps/stable/deluge/security.md +++ b/docs/apps/stable/deluge/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-deluge' of Deployment 'RELEASE-NAME-deluge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/digikam/CHANGELOG.md b/docs/apps/stable/digikam/CHANGELOG.md index c438b0a7140..2255224d11b 100644 --- a/docs/apps/stable/digikam/CHANGELOG.md +++ b/docs/apps/stable/digikam/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [digikam-2.0.28](https://github.com/truecharts/apps/compare/digikam-2.0.27...digikam-2.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [digikam-2.0.27](https://github.com/truecharts/apps/compare/digikam-2.0.26...digikam-2.0.27) (2021-12-19) diff --git a/docs/apps/stable/digikam/index.md b/docs/apps/stable/digikam/index.md index 7d5fca49977..e038fe84acc 100644 --- a/docs/apps/stable/digikam/index.md +++ b/docs/apps/stable/digikam/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/digikam/security.md b/docs/apps/stable/digikam/security.md index dfb74589fad..3db6fb78b5c 100644 --- a/docs/apps/stable/digikam/security.md +++ b/docs/apps/stable/digikam/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-digikam' of Deployment 'RELEASE-NAME-digikam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -309,3 +305,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/dillinger/CHANGELOG.md b/docs/apps/stable/dillinger/CHANGELOG.md index 5bf7dc51e1f..2944ab58c23 100644 --- a/docs/apps/stable/dillinger/CHANGELOG.md +++ b/docs/apps/stable/dillinger/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dillinger-0.0.7](https://github.com/truecharts/apps/compare/dillinger-0.0.6...dillinger-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dillinger-0.0.6](https://github.com/truecharts/apps/compare/dillinger-0.0.5...dillinger-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/dillinger/index.md b/docs/apps/stable/dillinger/index.md index 290da6eb1c8..93ba85b1f84 100644 --- a/docs/apps/stable/dillinger/index.md +++ b/docs/apps/stable/dillinger/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/dillinger/security.md b/docs/apps/stable/dillinger/security.md index 400bc093ebd..cd0b749263b 100644 --- a/docs/apps/stable/dillinger/security.md +++ b/docs/apps/stable/dillinger/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dillinger' of Deployment 'RELEASE-NAME-dillinger' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/dizquetv/CHANGELOG.md b/docs/apps/stable/dizquetv/CHANGELOG.md index 04727893adb..f6bf1a9c3d9 100644 --- a/docs/apps/stable/dizquetv/CHANGELOG.md +++ b/docs/apps/stable/dizquetv/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dizquetv-5.0.7](https://github.com/truecharts/apps/compare/dizquetv-5.0.6...dizquetv-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dizquetv-5.0.6](https://github.com/truecharts/apps/compare/dizquetv-5.0.5...dizquetv-5.0.6) (2021-12-19) diff --git a/docs/apps/stable/dizquetv/index.md b/docs/apps/stable/dizquetv/index.md index 3056295c0f7..2e16fc399c5 100644 --- a/docs/apps/stable/dizquetv/index.md +++ b/docs/apps/stable/dizquetv/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/dizquetv/security.md b/docs/apps/stable/dizquetv/security.md index 0265ebe4149..174e6ba9dfc 100644 --- a/docs/apps/stable/dizquetv/security.md +++ b/docs/apps/stable/dizquetv/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dizquetv' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dizquetv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-dizquetv' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/dokuwiki/CHANGELOG.md b/docs/apps/stable/dokuwiki/CHANGELOG.md index 8037dc9751e..c8215165cc9 100644 --- a/docs/apps/stable/dokuwiki/CHANGELOG.md +++ b/docs/apps/stable/dokuwiki/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dokuwiki-0.0.7](https://github.com/truecharts/apps/compare/dokuwiki-0.0.6...dokuwiki-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dokuwiki-0.0.6](https://github.com/truecharts/apps/compare/dokuwiki-0.0.5...dokuwiki-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/dokuwiki/index.md b/docs/apps/stable/dokuwiki/index.md index 6418bbb34e5..1328f8caa80 100644 --- a/docs/apps/stable/dokuwiki/index.md +++ b/docs/apps/stable/dokuwiki/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/dokuwiki/security.md b/docs/apps/stable/dokuwiki/security.md index 2d7fb428132..306c98642b3 100644 --- a/docs/apps/stable/dokuwiki/security.md +++ b/docs/apps/stable/dokuwiki/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dokuwiki' of Deployment 'RELEASE-NAME-dokuwiki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/domoticz/CHANGELOG.md b/docs/apps/stable/domoticz/CHANGELOG.md index f1da698e866..ec74dbe9b08 100644 --- a/docs/apps/stable/domoticz/CHANGELOG.md +++ b/docs/apps/stable/domoticz/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [domoticz-0.0.9](https://github.com/truecharts/apps/compare/domoticz-0.0.8...domoticz-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [domoticz-0.0.8](https://github.com/truecharts/apps/compare/domoticz-0.0.7...domoticz-0.0.8) (2021-12-19) diff --git a/docs/apps/stable/domoticz/index.md b/docs/apps/stable/domoticz/index.md index 58c5899bdf7..c9e6dd54d5e 100644 --- a/docs/apps/stable/domoticz/index.md +++ b/docs/apps/stable/domoticz/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/domoticz/security.md b/docs/apps/stable/domoticz/security.md index 0b371343a8d..24308923ec4 100644 --- a/docs/apps/stable/domoticz/security.md +++ b/docs/apps/stable/domoticz/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-domoticz' of Deployment 'RELEASE-NAME-domoticz' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/doublecommander/CHANGELOG.md b/docs/apps/stable/doublecommander/CHANGELOG.md index 275521d7b95..aa0294c9129 100644 --- a/docs/apps/stable/doublecommander/CHANGELOG.md +++ b/docs/apps/stable/doublecommander/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [doublecommander-2.0.29](https://github.com/truecharts/apps/compare/doublecommander-2.0.28...doublecommander-2.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [doublecommander-2.0.28](https://github.com/truecharts/apps/compare/doublecommander-2.0.27...doublecommander-2.0.28) (2021-12-19) diff --git a/docs/apps/stable/doublecommander/index.md b/docs/apps/stable/doublecommander/index.md index 24c2dfe55ad..bd5b82f1caa 100644 --- a/docs/apps/stable/doublecommander/index.md +++ b/docs/apps/stable/doublecommander/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/doublecommander/security.md b/docs/apps/stable/doublecommander/security.md index ce7cfcffac4..240b19663c8 100644 --- a/docs/apps/stable/doublecommander/security.md +++ b/docs/apps/stable/doublecommander/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-doublecommander' of Deployment 'RELEASE-NAME-doublecommander' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -328,3 +324,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/dsmr-reader/CHANGELOG.md b/docs/apps/stable/dsmr-reader/CHANGELOG.md index c8ad230adb6..759ee6342e1 100644 --- a/docs/apps/stable/dsmr-reader/CHANGELOG.md +++ b/docs/apps/stable/dsmr-reader/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [dsmr-reader-5.0.16](https://github.com/truecharts/apps/compare/dsmr-reader-5.0.15...dsmr-reader-5.0.16) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [dsmr-reader-5.0.15](https://github.com/truecharts/apps/compare/dsmr-reader-5.0.14...dsmr-reader-5.0.15) (2021-12-19) diff --git a/docs/apps/stable/dsmr-reader/index.md b/docs/apps/stable/dsmr-reader/index.md index 350ba2c0770..5409310b20e 100644 --- a/docs/apps/stable/dsmr-reader/index.md +++ b/docs/apps/stable/dsmr-reader/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/dsmr-reader/security.md b/docs/apps/stable/dsmr-reader/security.md index 274a4847b5f..4868b66c660 100644 --- a/docs/apps/stable/dsmr-reader/security.md +++ b/docs/apps/stable/dsmr-reader/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-dsmr-reader' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-dsmr-reader' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/dsmr-reader:v2021.09.02@sha256:bf3454b0b379d325d95ec0693e2634bcfd4bfd917ec59d0918ca60d32a6073c5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -394,7 +384,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/duckdns/CHANGELOG.md b/docs/apps/stable/duckdns/CHANGELOG.md index 34b58d6c739..4381a097a97 100644 --- a/docs/apps/stable/duckdns/CHANGELOG.md +++ b/docs/apps/stable/duckdns/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [duckdns-0.0.7](https://github.com/truecharts/apps/compare/duckdns-0.0.6...duckdns-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [duckdns-0.0.6](https://github.com/truecharts/apps/compare/duckdns-0.0.5...duckdns-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/duckdns/index.md b/docs/apps/stable/duckdns/index.md index 14940da5295..6534ac18235 100644 --- a/docs/apps/stable/duckdns/index.md +++ b/docs/apps/stable/duckdns/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/duckdns/security.md b/docs/apps/stable/duckdns/security.md index def4eb514d0..f1acc1fabb5 100644 --- a/docs/apps/stable/duckdns/security.md +++ b/docs/apps/stable/duckdns/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duckdns' of Deployment 'RELEASE-NAME-duckdns' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/duplicati/CHANGELOG.md b/docs/apps/stable/duplicati/CHANGELOG.md index d5ee9592cf3..be679cd5d5a 100644 --- a/docs/apps/stable/duplicati/CHANGELOG.md +++ b/docs/apps/stable/duplicati/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [duplicati-4.0.26](https://github.com/truecharts/apps/compare/duplicati-4.0.25...duplicati-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [duplicati-4.0.25](https://github.com/truecharts/apps/compare/duplicati-4.0.24...duplicati-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/duplicati/index.md b/docs/apps/stable/duplicati/index.md index 1fb770f60b5..f08349c043f 100644 --- a/docs/apps/stable/duplicati/index.md +++ b/docs/apps/stable/duplicati/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/duplicati/security.md b/docs/apps/stable/duplicati/security.md index 13d21cffa4e..02530d23bd1 100644 --- a/docs/apps/stable/duplicati/security.md +++ b/docs/apps/stable/duplicati/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-duplicati' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-duplicati' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-duplicati' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/emby/CHANGELOG.md b/docs/apps/stable/emby/CHANGELOG.md index 50022e2ddb8..8e780db57d4 100644 --- a/docs/apps/stable/emby/CHANGELOG.md +++ b/docs/apps/stable/emby/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [emby-9.0.28](https://github.com/truecharts/apps/compare/emby-9.0.27...emby-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [emby-9.0.27](https://github.com/truecharts/apps/compare/embystat-0.0.5...emby-9.0.27) (2021-12-19) diff --git a/docs/apps/stable/emby/index.md b/docs/apps/stable/emby/index.md index b4ddc8f7414..f78a31c9594 100644 --- a/docs/apps/stable/emby/index.md +++ b/docs/apps/stable/emby/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/emby/security.md b/docs/apps/stable/emby/security.md index b2854808384..cb31e6a9d99 100644 --- a/docs/apps/stable/emby/security.md +++ b/docs/apps/stable/emby/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emby' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emby' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-emby' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -163,4 +160,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/embystat/CHANGELOG.md b/docs/apps/stable/embystat/CHANGELOG.md index 591a11d7f1a..219352df417 100644 --- a/docs/apps/stable/embystat/CHANGELOG.md +++ b/docs/apps/stable/embystat/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [embystat-0.0.7](https://github.com/truecharts/apps/compare/embystat-0.0.6...embystat-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [embystat-0.0.6](https://github.com/truecharts/apps/compare/embystat-0.0.5...embystat-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/embystat/index.md b/docs/apps/stable/embystat/index.md index 81497bb37be..6b3d88616ab 100644 --- a/docs/apps/stable/embystat/index.md +++ b/docs/apps/stable/embystat/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/embystat/security.md b/docs/apps/stable/embystat/security.md index 79870bf4b54..ee24b1de313 100644 --- a/docs/apps/stable/embystat/security.md +++ b/docs/apps/stable/embystat/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-embystat' of Deployment 'RELEASE-NAME-embystat' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/emulatorjs/CHANGELOG.md b/docs/apps/stable/emulatorjs/CHANGELOG.md index 4850119cdb0..3e70518cc7a 100644 --- a/docs/apps/stable/emulatorjs/CHANGELOG.md +++ b/docs/apps/stable/emulatorjs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [emulatorjs-0.0.9](https://github.com/truecharts/apps/compare/emulatorjs-0.0.8...emulatorjs-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [emulatorjs-0.0.8](https://github.com/truecharts/apps/compare/emulatorjs-0.0.7...emulatorjs-0.0.8) (2021-12-20) diff --git a/docs/apps/stable/emulatorjs/index.md b/docs/apps/stable/emulatorjs/index.md index f92023ef8de..7f667739afb 100644 --- a/docs/apps/stable/emulatorjs/index.md +++ b/docs/apps/stable/emulatorjs/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/emulatorjs/security.md b/docs/apps/stable/emulatorjs/security.md index 9d8360fcee3..4738e47a3ef 100644 --- a/docs/apps/stable/emulatorjs/security.md +++ b/docs/apps/stable/emulatorjs/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-emulatorjs' of Deployment 'RELEASE-NAME-emulatorjs' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -87,5 +84,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/endlessh/CHANGELOG.md b/docs/apps/stable/endlessh/CHANGELOG.md index 409175859e4..66a62d0e9a3 100644 --- a/docs/apps/stable/endlessh/CHANGELOG.md +++ b/docs/apps/stable/endlessh/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [endlessh-0.0.7](https://github.com/truecharts/apps/compare/endlessh-0.0.6...endlessh-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [endlessh-0.0.6](https://github.com/truecharts/apps/compare/endlessh-0.0.5...endlessh-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/endlessh/index.md b/docs/apps/stable/endlessh/index.md index 7b503c90d5d..b9f63eb7ead 100644 --- a/docs/apps/stable/endlessh/index.md +++ b/docs/apps/stable/endlessh/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/endlessh/security.md b/docs/apps/stable/endlessh/security.md index 72d65450420..7fd043989a5 100644 --- a/docs/apps/stable/endlessh/security.md +++ b/docs/apps/stable/endlessh/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-endlessh' of Deployment 'RELEASE-NAME-endlessh' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/esphome/CHANGELOG.md b/docs/apps/stable/esphome/CHANGELOG.md index 85dc904417d..3ce78a3fcd8 100644 --- a/docs/apps/stable/esphome/CHANGELOG.md +++ b/docs/apps/stable/esphome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [esphome-9.0.31](https://github.com/truecharts/apps/compare/esphome-9.0.30...esphome-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [esphome-9.0.30](https://github.com/truecharts/apps/compare/esphome-9.0.29...esphome-9.0.30) (2021-12-19) diff --git a/docs/apps/stable/esphome/index.md b/docs/apps/stable/esphome/index.md index cd74079cea3..4051e002e8c 100644 --- a/docs/apps/stable/esphome/index.md +++ b/docs/apps/stable/esphome/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/esphome/security.md b/docs/apps/stable/esphome/security.md index 72108945c41..a4df21bffb3 100644 --- a/docs/apps/stable/esphome/security.md +++ b/docs/apps/stable/esphome/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-esphome' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-esphome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-esphome' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/etherpad/CHANGELOG.md b/docs/apps/stable/etherpad/CHANGELOG.md index 0fee3d5f2b3..8a830c4ebd2 100644 --- a/docs/apps/stable/etherpad/CHANGELOG.md +++ b/docs/apps/stable/etherpad/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [etherpad-5.0.17](https://github.com/truecharts/apps/compare/etherpad-5.0.16...etherpad-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [etherpad-5.0.16](https://github.com/truecharts/apps/compare/etherpad-5.0.15...etherpad-5.0.16) (2021-12-19) diff --git a/docs/apps/stable/etherpad/index.md b/docs/apps/stable/etherpad/index.md index f7db4a3b3e0..02c02c83b08 100644 --- a/docs/apps/stable/etherpad/index.md +++ b/docs/apps/stable/etherpad/index.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/etherpad/security.md b/docs/apps/stable/etherpad/security.md index de2df2afea6..b4a3f4b8673 100644 --- a/docs/apps/stable/etherpad/security.md +++ b/docs/apps/stable/etherpad/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-etherpad' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-etherpad' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/etherpad:version-1.8.14@sha256:4900f0e787ca22cf93090ae44ecceb5689d4427c739e1eb637a6e3a913161bf8 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -417,7 +407,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/external-service/CHANGELOG.md b/docs/apps/stable/external-service/CHANGELOG.md index 113d5f57a3f..3b6aaba9ac2 100644 --- a/docs/apps/stable/external-service/CHANGELOG.md +++ b/docs/apps/stable/external-service/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [external-service-4.0.25](https://github.com/truecharts/apps/compare/external-service-4.0.24...external-service-4.0.25) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [external-service-4.0.24](https://github.com/truecharts/apps/compare/external-service-4.0.23...external-service-4.0.24) (2021-12-19) diff --git a/docs/apps/stable/external-service/index.md b/docs/apps/stable/external-service/index.md index 14ec5cfbdd1..c15b5dbaf03 100644 --- a/docs/apps/stable/external-service/index.md +++ b/docs/apps/stable/external-service/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/filezilla/CHANGELOG.md b/docs/apps/stable/filezilla/CHANGELOG.md index 78b2cb2dc81..5093e26eb1c 100644 --- a/docs/apps/stable/filezilla/CHANGELOG.md +++ b/docs/apps/stable/filezilla/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [filezilla-2.0.26](https://github.com/truecharts/apps/compare/filezilla-2.0.25...filezilla-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [filezilla-2.0.25](https://github.com/truecharts/apps/compare/filezilla-2.0.24...filezilla-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/filezilla/index.md b/docs/apps/stable/filezilla/index.md index adff63fd98d..048f286edcd 100644 --- a/docs/apps/stable/filezilla/index.md +++ b/docs/apps/stable/filezilla/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/filezilla/security.md b/docs/apps/stable/filezilla/security.md index d1f94876f83..4954ca36b27 100644 --- a/docs/apps/stable/filezilla/security.md +++ b/docs/apps/stable/filezilla/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-filezilla' of Deployment 'RELEASE-NAME-filezilla' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/fireflyiii/CHANGELOG.md b/docs/apps/stable/fireflyiii/CHANGELOG.md index 74de8f47e63..5a8c8bd5091 100644 --- a/docs/apps/stable/fireflyiii/CHANGELOG.md +++ b/docs/apps/stable/fireflyiii/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fireflyiii-13.1.8](https://github.com/truecharts/apps/compare/fireflyiii-13.1.7...fireflyiii-13.1.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fireflyiii-13.1.7](https://github.com/truecharts/apps/compare/fireflyiii-13.1.6...fireflyiii-13.1.7) (2021-12-19) diff --git a/docs/apps/stable/fireflyiii/index.md b/docs/apps/stable/fireflyiii/index.md index 3143ad27985..368963bf327 100644 --- a/docs/apps/stable/fireflyiii/index.md +++ b/docs/apps/stable/fireflyiii/index.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/fireflyiii/security.md b/docs/apps/stable/fireflyiii/security.md index 81070e919dd..362dcc4d25e 100644 --- a/docs/apps/stable/fireflyiii/security.md +++ b/docs/apps/stable/fireflyiii/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,17 +48,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-fireflyiii' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fireflyiii' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fireflyiii' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'fireflyiii' of CronJob 'RELEASE-NAME-fireflyiii-cronjob' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -82,13 +66,13 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/fireflyiii-core:v5.6.5@sha256:fe75d9df1daf62871eccb976643ff393ed1bd402b61baa0f17f7ad5289697264 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -125,7 +109,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -351,6 +335,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -361,6 +347,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -371,6 +359,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -381,6 +371,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -901,7 +893,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -920,7 +912,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -930,13 +922,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -983,7 +977,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | locales | CVE-2021-33574 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | locales | CVE-2021-35942 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | locales | CVE-2020-1751 | HIGH | 2.28-10 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751
https://linux.oracle.com/cve/CVE-2020-1751.html
https://linux.oracle.com/errata/ELSA-2020-4444.html
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://ubuntu.com/security/notices/USN-4416-1
https://usn.ubuntu.com/4416-1/
| @@ -1105,7 +1103,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1353,7 +1351,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/firefox-syncserver/CHANGELOG.md b/docs/apps/stable/firefox-syncserver/CHANGELOG.md index 9b5a39ae94b..475852f0943 100644 --- a/docs/apps/stable/firefox-syncserver/CHANGELOG.md +++ b/docs/apps/stable/firefox-syncserver/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [firefox-syncserver-5.0.17](https://github.com/truecharts/apps/compare/firefox-syncserver-5.0.16...firefox-syncserver-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [firefox-syncserver-5.0.16](https://github.com/truecharts/apps/compare/firefox-syncserver-5.0.15...firefox-syncserver-5.0.16) (2021-12-19) diff --git a/docs/apps/stable/firefox-syncserver/index.md b/docs/apps/stable/firefox-syncserver/index.md index 3cf4805b5c9..72fa43e8cd1 100644 --- a/docs/apps/stable/firefox-syncserver/index.md +++ b/docs/apps/stable/firefox-syncserver/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/firefox-syncserver/security.md b/docs/apps/stable/firefox-syncserver/security.md index 9514465a5b3..ef7fd451066 100644 --- a/docs/apps/stable/firefox-syncserver/security.md +++ b/docs/apps/stable/firefox-syncserver/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,15 +36,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox-syncserver' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-firefox-syncserver' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -62,10 +52,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/firefox-syncserver:v1.8.0@sha256:d0fbf65c8c7a99ad4ba7ffcfdad2e7b2555e0d829867c21cefc9314ace94f747 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -102,7 +92,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -443,7 +433,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/firefox/CHANGELOG.md b/docs/apps/stable/firefox/CHANGELOG.md index 4de64dbf86a..b46b1a1a26f 100644 --- a/docs/apps/stable/firefox/CHANGELOG.md +++ b/docs/apps/stable/firefox/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [firefox-0.0.7](https://github.com/truecharts/apps/compare/firefox-0.0.6...firefox-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [firefox-0.0.6](https://github.com/truecharts/apps/compare/firefox-0.0.5...firefox-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/firefox/index.md b/docs/apps/stable/firefox/index.md index e1f7c4e9b52..93a5b4453dc 100644 --- a/docs/apps/stable/firefox/index.md +++ b/docs/apps/stable/firefox/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/firefox/security.md b/docs/apps/stable/firefox/security.md index e9be5f9b420..4768a48bbdd 100644 --- a/docs/apps/stable/firefox/security.md +++ b/docs/apps/stable/firefox/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-firefox' of Deployment 'RELEASE-NAME-firefox' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/flaresolverr/CHANGELOG.md b/docs/apps/stable/flaresolverr/CHANGELOG.md index d5668f943e8..72d4ed2bdc0 100644 --- a/docs/apps/stable/flaresolverr/CHANGELOG.md +++ b/docs/apps/stable/flaresolverr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [flaresolverr-4.0.28](https://github.com/truecharts/apps/compare/flaresolverr-4.0.27...flaresolverr-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [flaresolverr-4.0.27](https://github.com/truecharts/apps/compare/flaresolverr-4.0.26...flaresolverr-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/flaresolverr/index.md b/docs/apps/stable/flaresolverr/index.md index 2cee3ece799..89d6deca87d 100644 --- a/docs/apps/stable/flaresolverr/index.md +++ b/docs/apps/stable/flaresolverr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/flaresolverr/security.md b/docs/apps/stable/flaresolverr/security.md index 8e810c16560..7de86c46a12 100644 --- a/docs/apps/stable/flaresolverr/security.md +++ b/docs/apps/stable/flaresolverr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flaresolverr' of Deployment 'RELEASE-NAME-flaresolverr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/fleet/CHANGELOG.md b/docs/apps/stable/fleet/CHANGELOG.md index 443520c74dc..a4cd2529076 100644 --- a/docs/apps/stable/fleet/CHANGELOG.md +++ b/docs/apps/stable/fleet/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fleet-0.0.7](https://github.com/truecharts/apps/compare/fleet-0.0.6...fleet-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fleet-0.0.6](https://github.com/truecharts/apps/compare/fleet-0.0.5...fleet-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/fleet/index.md b/docs/apps/stable/fleet/index.md index 1d35ec31bdd..a77be5e62e9 100644 --- a/docs/apps/stable/fleet/index.md +++ b/docs/apps/stable/fleet/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/fleet/security.md b/docs/apps/stable/fleet/security.md index 21949290979..1fd81fc4e36 100644 --- a/docs/apps/stable/fleet/security.md +++ b/docs/apps/stable/fleet/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fleet' of Deployment 'RELEASE-NAME-fleet' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/fleet:v2.3.2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -290,8 +283,8 @@ hide: | com.fasterxml.jackson.core:jackson-databind | CVE-2019-12384 | MEDIUM | 2.9.6 | 2.7.9.6, 2.8.11.4, 2.9.9.1 |
Expand...https://access.redhat.com/errata/RHSA-2019:1820
https://access.redhat.com/errata/RHSA-2019:2720
https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:2935
https://access.redhat.com/errata/RHSA-2019:2936
https://access.redhat.com/errata/RHSA-2019:2937
https://access.redhat.com/errata/RHSA-2019:2938
https://access.redhat.com/errata/RHSA-2019:2998
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3200
https://access.redhat.com/errata/RHSA-2019:3292
https://access.redhat.com/errata/RHSA-2019:3297
https://access.redhat.com/errata/RHSA-2019:3901
https://access.redhat.com/errata/RHSA-2019:4352
https://blog.doyensec.com/2019/07/22/jackson-gadgets.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12384
https://doyensec.com/research.html
https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234
https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad
https://github.com/FasterXML/jackson-databind/issues/2334
https://github.com/advisories/GHSA-mph4-vhrx-mv67
https://linux.oracle.com/cve/CVE-2019-12384.html
https://linux.oracle.com/errata/ELSA-2019-2720.html
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/
https://nvd.nist.gov/vuln/detail/CVE-2019-12384
https://seclists.org/bugtraq/2019/Oct/6
https://security.netapp.com/advisory/ntap-20190703-0002/
https://www.debian.org/security/2019/dsa-4542
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | com.fasterxml.jackson.core:jackson-databind | CVE-2019-12814 | MEDIUM | 2.9.6 | 2.7.9.6, 2.8.11.4, 2.9.9.1 |
Expand...https://access.redhat.com/errata/RHSA-2019:2858
https://access.redhat.com/errata/RHSA-2019:2935
https://access.redhat.com/errata/RHSA-2019:2936
https://access.redhat.com/errata/RHSA-2019:2937
https://access.redhat.com/errata/RHSA-2019:2938
https://access.redhat.com/errata/RHSA-2019:3044
https://access.redhat.com/errata/RHSA-2019:3045
https://access.redhat.com/errata/RHSA-2019:3046
https://access.redhat.com/errata/RHSA-2019:3050
https://access.redhat.com/errata/RHSA-2019:3149
https://access.redhat.com/errata/RHSA-2019:3200
https://access.redhat.com/errata/RHSA-2019:3292
https://access.redhat.com/errata/RHSA-2019:3297
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12814
https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5
https://github.com/FasterXML/jackson-databind/issues/2341
https://github.com/advisories/GHSA-cmfg-87vq-g5g4
https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E
https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E
https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd@%3Ccommits.accumulo.apache.org%3E
https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E
https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E
https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/
https://nvd.nist.gov/vuln/detail/CVE-2019-12814
https://security.netapp.com/advisory/ntap-20190625-0006/
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.7 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-core | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.eclipse.jetty:jetty-client | CVE-2020-27216 | HIGH | 9.4.20.v20190813 | 9.3.29.v20201019, 9.4.32.v20200930, 11.0.1 |
Expand...https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921
https://cwe.mitre.org/data/definitions/378.html
https://cwe.mitre.org/data/definitions/379.html
https://github.com/advisories/GHSA-g3wg-6mcf-8jj6
https://github.com/eclipse/jetty.project/issues/5451
https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6
https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf-8jj6#advisory-comment-63053
https://github.com/github/codeql/pull/4473
https://lists.apache.org/thread.html/r0259b14ae69b87821e27fed1f5333ea86018294fd31aab16b1fac84e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r07525dc424ed69b3919618599e762f9ac03791490ca9d724f2241442@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r09b345099b4f88d2bed7f195a96145849243fb4e53661aa3bcf4c176@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d7ad4f02c44d5d53a9ffcbca7ff4a8138241322da9c5c35b5429630@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r0d95e01f52667f44835c40f6dea72bb4397f33cd70a564ea74f3836d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r0df8fe10fc36028cf6d0381ab66510917d0d68bc5ef7042001d03830@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0e9efe032cc65433251ee6470c66c334d4e7db9101e24cf91a3961f2@%3Ccommits.directory.apache.org%3E
https://lists.apache.org/thread.html/r0f5e9b93133ef3aaf31484bc3e15cc4b85f8af0fe4de2dacd9379d72@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r100c5c7586a23a19fdb54d8a32e17cd0944bdaa46277b35c397056f6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r171846414347ec5fed38241a9f8a009bd2c89d902154c6102b1fb39a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r185d10aae8161c08726f3ba9a1f1c47dfb97624ea6212fa217173204@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r18b6f10d9939419bae9c225d5058c97533cb376c9d6d0a0733ddd48d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r19e8b338af511641d211ff45c43646fe1ae19dc9897d69939c09cabe@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1d40368a309f9d835dcdd900249966e4fcbdf98c1cc4c84db2cd9964@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1d45051310b11c6d6476f20d71b08ea97cb76846cbf61d196bac1c3f@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1dbb87c9255ecefadd8de514fa1d35c1d493c0527d7672cf40505d04@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1ed79516bd6d248ea9f0e704dbfd7de740d5a75b71c7be8699fec824@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1ef28b89ff0281c87ba3a7659058789bf28a99b8074191f1c3678db8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r1fe31643fc34b4a33ae3d416d92c271aa97663f1782767d25e1d9ff8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2122537d3f9beb0ce59f44371a951b226406719919656ed000984bd0@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r279254a1bd6434c943da52000476f307e62b6910755387aeca1ec9a1@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2aa316d008dab9ae48350b330d15dc1b863ea2a933558fbfc42b91a6@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2d17b2a4803096ba427f3575599ea29b55f5cf9dbc1f12ba044cae1a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2e02700f7cfecb213de50be83e066086bea90278cd753db7fdc2ccff@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r2f732ee49d00610683ab5ddb4692ab25136b00bfd132ca3a590218a9@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3042a9dd2973aa229e52d022df7813e4d74b67df73bfa6d97bb0caf8@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r336b1694a01858111e4625fb9ab2b07ad43a64a525cf6402e06aa6bf@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r351298dd39fc1ab63303be94b0c0d08acd72b17448e0346d7386189b@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E
https://lists.apache.org/thread.html/r382870d6ccfd60533eb0d980688261723ed8a0704dafa691c4e9aa68@%3Ccommits.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r3a763de620be72b6d74f46ec4bf39c9f35f8a0b39993212c0ac778ec@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3b0ce1549a1ccdd7e51ec66daf8d54d46f1571edbda88ed09c96d7da@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3e05ab0922876e74fea975d70af82b98580f4c14ba643c4f8a9e3a94@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r3f32cb4965239399c22497a0aabb015b28b2372d4897185a6ef0ccd7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r407c316f6113dfc76f7bb3cb1693f08274c521064a92e5214197548e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4179c71908778cc0598ee8ee1eaed9b88fc5483c65373f45e087f650@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r44115ebfbf3b7d294d7a75f2d30bcc822dab186ebbcc2dce11915ca9@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4946ffd86ad6eb7cb7863311235c914cb41232380de8d9dcdb3c115c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r4f29fb24639ebc5d15fc477656ebc2b3aa00fcfbe197000009c26b40@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r503045a75f4419d083cb63ac89e765d6fb8b10c7dacc0c54fce07cff@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/r547bb14c88c5da2588d853ed3030be0109efa537dd797877dff14afd@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5494fdaf4a0a42a15c49841ba7ae577d466d09239ee1050458da0f29@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r556787f1ab14da034d79dfff0c123c05877bbe89ef163fd359b4564c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r568d354961fa88f206dc345411fb11d245c6dc1a8da3e80187fc6706@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r58f5b14dc5ae43583db3a7e872419aca97ebe47bcd7f7334f4128016@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r59e0878013d329dcc481eeafebdb0ee445b1e2852d0c4827b1ddaff2@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5a07f274f355c914054c7357ad6d3456ffaca064f26cd780acb90a9a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r5a9462096c71593e771602beb0e69357adb5175d9a5c18d5181e0ab4@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6236ae4adc401e3b2f2575c22865f2f6c6ea9ff1d7b264b40d9602af@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r66e99d973fd79ddbcb3fbdb24f4767fe9b911f5b0abb05d7b6f65801@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r6b83ca85c8f9a6794b1f85bc70d1385ed7bc1ad07750d0977537154a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6dfa64ecc3d67c1a71c08bfa04064549179d499f8e20a8285c57bd51@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r6f51a654ac2e67e3d1c65a8957cbbb127c3f15b64b4fcd626df03633@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r70f8bcccd304bd66c1aca657dbfc2bf11f73add9032571b01f1f733d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r71da5f51ef04cb95abae560425dce9667740cbd567920f516f76efb7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r73b5a9b677b707bbb7c1469ea746312c47838b312603bada9e382bba@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r761a52f1e214efec286ee80045d0012e955eebaa72395ad62cccbcfc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r769411eb43dd9ef77665700deb7fc491fc3ceb532914260c90b56f2f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r77dd041d8025a869156481d2268c67ad17121f64e31f9b4a1a220145@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r7bdc83513c12db1827b79b8d57a7a0975a25d28bc6c5efe590ec1e02@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r7da5ae60d7973e8894cfe92f49ecb5b47417eefab4c77cc87514d3cf@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/r8045eedd6bb74efcd8e01130796adbab98ee4a0d1273509fb1f2077a@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r819857361f5a156e90d6d06ccf6c41026bc99030d60d0804be3a9957@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r827d17bf6900eddc686f4b6ee16fc5e52ca0070f8df7612222c40ac5@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r874688141495df766e62be095f1dfb0bf4a24ca0340d8e0215c03fab@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r87b0c69fef09277333a7e1716926d1f237d462e143a335854ddd922f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r87d8337300a635d66f0bb838bf635cdfcbba6b92c608a7813adbf4f4@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8866f0cd2a3b319288b7eea20ac137b9f260c813d10ee2db88b65d32@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8cacf91ae1b17cc6531d20953c52fa52f6fd3191deb3383446086ab7@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8dd01541fc49d24ec223365a9974231cbd7378b749247a89b0a52210@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r8fead0144bb84d8714695c43607dca9c5101aa028a431ec695882fe5@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r90b5ac6e2bf190a5297bda58c7ec76d01cd86ff050b2470fcd9f4b35@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r911c1879258ebf98bca172c0673350eb7ea6569ca1735888d4cb7adc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r916b6542bd5b15a8a7ff8fc14a0e0331e8e3e9d682f22768ae71d775@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r93b240be16e642579ed794325bae31b040e1af896ecc12466642e19d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r93d5e81e879120d8d87925dbdd4045cb3afa9b066f4370f60b626ce3@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r9b790fe3a93121199f41258474222f15002b2f729495aa7ecbf90718@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9c010b79140452294292379183e7fe8e3533c5bb4db3f3fb39a6df61@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9cc76b98f87738791b8ec3736755f92444d3c8cb26bd4e4ffdb5c1cc@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9cd444f944241dc26d9b8b007fe8971ed7f005b56befef7a4f4fb827@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/r9d9b4b93df7f92cdf1147db0fc169be1776c93d1fbc63bc65721fffd@%3Cdev.knox.apache.org%3E
https://lists.apache.org/thread.html/r9f8c45a2a4540911cd8bd0485f67e8091883c9234d7a3aeb349c46c1@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/ra1f19625cc67ac1b459c558f2ea5647d71ce51c6fe4f4cb03baec849@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra55e04d5a73afcb8383f4386e2b26832c6e3972e53827021ab885943@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/ra5b7313d8cc9411db6790adfba33f2cf0665cb77adb7b02043c95867@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/raa9c370ab42d737e93bc1795bb6a2187d7c60210cd5e3b3ce8f3c484@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rad255c736fad46135f1339408cb0147d0671e45c376c3be85ceeec1a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rae15d73cabef55bad148e4e6449b05da95646a2a8db3fc938e858dff@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/raf9c581b793c30ff8f55f2415c7bd337eb69775aae607bf9ed1b16fb@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rafb023a7c61180a1027819678eb2068b0b60cd5c2559cb8490e26c81@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb077d35f2940191daeefca0d6449cddb2e9d06bcf8f5af4da2df3ca2@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb5f2558ea2ac63633dfb04db1e8a6ea6bb1a2b8614899095e16c6233@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb69b1d7008a4b3de5ce5867e41a455693907026bc70ead06867aa323@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb7e159636b26156f6ef2b2a1a79b3ec9a026923b5456713e68f7c18e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb81a018f83fe02c95a2138a7bb4f1e1677bd7e1fc1e7024280c2292d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb8ad3745cb94c60d44cc369aff436eaf03dbc93112cefc86a2ed53ba@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rb8c007f87dc57731a7b9a3b05364530422535b7e0bc6a0c5b68d4d55@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/rbc5a622401924fadab61e07393235838918228b3d8a1a6704295b032@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rbc5a8d7a0a13bc8152d427a7e9097cdeb139c6cfe111b2f00f26d16b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbf99e4495461099cad9aa62e0164f8f25a7f97b791b4ace56e375f8d@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1646894341450fdc4f7e96a88f5e2cf18d8004714f98aec6b831b3e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc1d9b8e9d17749d4d2b9abaaa72c422d090315bd6bc0ae73a16abc1c@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc2e24756d28580eeac811c5c6a12012c9f424b6e5bffb89f98ee3d03@%3Cdev.felix.apache.org%3E
https://lists.apache.org/thread.html/rc44d1147f78496ec9932a38b28795ff4fd0c4fa6e3b6f5cc33c14d29@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc4b972ea10c5a65c6a88a6e233778718ab9af7f484affdd5e5de0cff@%3Ccommits.felix.apache.org%3E
https://lists.apache.org/thread.html/rc77918636d8744d50312e4f67ba2e01f47db3ec5144540df8745cb38@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rc8dd95802be0cca8d7d0929c0c8484ede384ecb966b2a9dc7197b089@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rc9d2ab8a6c7835182f20b01104798e67c75db655c869733a0713a590@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rccedec4cfd5df6761255b71349e3b7c27ee0745bd33698a71b1775cf@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcdcf32952397c83a1d617a8c9cd5c15c98b8d0d38a607972956bde7e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcdd56ab4255801a0964dcce3285e87f2c6994e6469e189f6836f34e3@%3Cnotifications.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rcfb95a7c69c4b9c082ea1918e812dfc45aa0d1e120fd47f68251a336@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rcff5caebfd535195276aaabc1b631fd55a4ff6b14e2bdfe33f18ff91@%3Creviews.iotdb.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd58b60ab2e49ebf21022e59e280feb25899ff785c88f31fe314aa5b9@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/rd7e62e2972a41c2658f41a824b8bdd15644d80fcadc51fe7b7c855de@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rdbf1cd0ab330c032f3a09b453cb6405dccc905ad53765323bddab957@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rdddb4b06e86fd58a1beda132f22192af2f9b56aae8849cb3767ccd55@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rde11c433675143d8d27551c3d9e821fe1955f1551a518033d3716553@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rde782fd8e133f7e04e50c8aaa4774df524367764eb5b85bf60d96747@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re08b03cd1754b32f342664eead415af48092c630c8e3e0deba862a26@%3Ccommits.shiro.apache.org%3E
https://lists.apache.org/thread.html/re5706141ca397587f7ee0f500a39ccc590a41f802fc125fc135cb92f@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ree506849c4f04376793b1a3076bc017da60b8a2ef2702dc214ff826f@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/refbbb0eb65c185d1fa491cee08ac8ed32708ce3b269133a6da264317@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rf00ea6376f3d0e8b8f62cf6d4a4f28b24e27193acd2c851f618aa41e@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rf3bc023a7cc729aeac72f482e2eeeab9008aa6b1dadbeb3f45320cae@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfd9f102864a039f7fda64a580dfe1a342d65d7b723ca06dc9fbceb31@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfe5caef1fd6cf4b8ceac1b63c33195f2908517b665c946c020d3fbd6@%3Cissues.beam.apache.org%3E
https://lists.apache.org/thread.html/rfe6ba83d14545e982400dea89e68b10113cb5202a3dcb558ce64842d@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rff0ad6a7dac2182421e2db2407e44fbb61a89904adfd91538f21fbf8@%3Cissues.beam.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/05/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2020-27216
https://security.netapp.com/advisory/ntap-20201123-0005/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.eclipse.jetty:jetty-client | CVE-2021-28165 | HIGH | 9.4.20.v20190813 | 9.4.39.v20210325, 10.0.2, 11.0.2 |
Expand...http://www.openwall.com/lists/oss-security/2021/04/20/3
https://github.com/advisories/GHSA-26vr-8j45-3r4w
https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711cbf334e2913332730a@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a8b928916ef65dd2ad@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47da164002bf2baffe5@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002da0ddac5ad851ae7e7@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e66970eafd54f9c3e2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c1fab8203ebd212add@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391cf94ec4e1f4537ae3@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35bec149c0cc247579c42@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r0f02034a33076fd7243cf3a8807d2766e373f5cb2e7fd0c9a78f97c4@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r111f1ce28b133a8090ca4f809a1bdf18a777426fc058dc3a16c39c66@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r17e26cf9a1e3cbc09522d15ece5d7c7a00cdced7641b92a22a783287@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r23785214d47673b811ef119ca3a40f729801865ea1e891572d15faa6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d668a9497c999946cd78@%3Ccommits.spark.apache.org%3E
https://lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r2f2d9c3b7cc750a6763d6388bcf5db0c7b467bd8be6ac4d6aea4f0cf@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r31f591a0deac927ede8ccc3eac4bb92697ee2361bf01549f9e3440ca@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r33eb3889ca0aa12720355e64fc2f8f1e8c0c28a4d55b3b4b8891becb@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r40136c2010fccf4fb2818a965e5d7ecca470e5f525c232ec5b8eb83a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r401b1c592f295b811608010a70792b11c91885b72af9f9410cffbe35@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r411d75dc6bcefadaaea246549dd18e8d391a880ddf28a796f09ce152@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r47a7542ab61da865fff3db0fe74bfe76c89a37b6e6d2c2a423f8baee@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r4891d45625cc522fe0eb764ac50d48bcca9c0db4805ea4a998d4c225@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r4a66bfbf62281e31bc1345ebecbfd96f35199eecd77bfe4e903e906f@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r4abbd760d24bab2b8f1294c5c9216ae915100099c4391ad64e9ae38b@%3Cdev.hbase.apache.org%3E
https://lists.apache.org/thread.html/r4b1fef117bccc7f5fd4c45fd2cabc26838df823fe5ca94bc42a4fd46@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r520c56519b8820955a86966f499e7a0afcbcf669d6f7da59ef1eb155@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r56e5568ac73daedcb3b5affbb4b908999f03d3c1b1ada3920b01e959@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r5b3693da7ecb8a75c0e930b4ca26a5f97aa0207d9dae4aa8cc65fe6b@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r5d1f16dca2e010193840068f1a1ec17b7015e91acc646607cbc0a4da@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r5f172f2dd8fb02f032ef4437218fd4f610605a3dd4f2a024c1e43b94@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r64ff94118f6c80e6c085c6e2d51bbb490eaefad0642db8c936e4f0b7@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r6535b2beddf0ed2d263ab64ff365a5f790df135a1a2f45786417adb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r65daad30d13f7c56eb5c3d7733ad8dddbf62c469175410777a78d812@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r694e57d74fcaa48818a03c282aecfa13ae68340c798dfcb55cb7acc7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6ac9e263129328c0db9940d72b4a6062e703c58918dd34bd22cdf8dd@%3Cissues.ignite.apache.org%3E
https://lists.apache.org/thread.html/r6b070441871a4e6ce8bb63e190c879bb60da7c5e15023de29ebd4f9f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6ce2907b2691c025250ba010bc797677ef78d5994d08507a2e5477c9@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r6f256a1d15505f79f4050a69bb8f27b34cb353604dd2f765c9da5df7@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r71031d0acb1de55c9ab32f4750c50ce2f28543252e887ca03bd5621e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r7189bf41cb0c483629917a01cf296f9fbdbda3987084595192e3845d@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587fd5939fe8be09907c7@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r746434be6abff9ad321ff54ecae09e1f09c1c7c139021f40a5774090@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r769155244ca2da2948a44091bb3bb9a56e7e1c71ecc720b8ecf281f0@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7bf7004c18c914fae3d5a6a0191d477e5b6408d95669b3afbf6efa36@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7c40fb3a66a39b6e6c83b0454bc6917ffe6c69e3131322be9c07a1da@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r81748d56923882543f5be456043c67daef84d631cf54899082058ef1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r83453ec252af729996476e5839d0b28f07294959d60fea1bd76f7d81@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1de49dc7fd04cad1ebc@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r940f15db77a96f6aea92d830bc94d8d95f26cc593394d144755824da@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r942f4a903d0abb25ac75c592e57df98dea51350e8589269a72fd7913@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r9974f64723875052e02787b2a5eda689ac5247c71b827d455e5dc9a6@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r9b793db9f395b546e66fb9c44fe1cd75c7755029e944dfee31b8b779@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9fae5a4087d9ed1c9d4f0c7493b6981a4741cfb4bebb2416da638424@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/ra210e38ae0bf615084390b26ba01bb5d66c0a76f232277446ae0948a@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra21b3e6bd9669377139fe33fb46edf6fece3f31375bc42a0dcc964b2@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra50519652b0b7f869a14fbfb4be9758a29171d7fe561bb7e036e8449@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/ra9dd15ba8a4fb7e42c7fe948a6d6b3868fd6bbf8e3fb37fcf33b2cd0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rae8bbc5a516f3e21b8a55e61ff6ad0ced03bdbd116d2170a3eed9f5c@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/raea6e820644e8c5a577f77d4e2044f8ab52183c2536b00c56738beef@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb00345f6b1620b553d2cc1acaf3017aa75cea3776b911e024fa3b187@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb11a13e623218c70b9f2a2d0d122fdaaf905e04a2edcd23761894464@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb1624b9777a3070135e94331a428c6653a6a1edccd56fa9fb7a547f2@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb2d34abb67cdf525945fe4b821c5cdbca29a78d586ae1f9f505a311c@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb66ed0b4bb74836add60dd5ddf9172016380b2aeefb7f96fe348537b@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rb8f5a6ded384eb00608e6137e87110e7dd7d5054cc34561cb89b81af@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc457975fc0445ac97f@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/rbba0b02a3287e34af328070dd58f7828612f96e2e64992137f4dc63d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc075a4ac85e7a8e47420b7383f16ffa0af3b792b8423584735f369f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rbcd7b477df55857bb6cae21fcc4404683ac98aac1a47551f0dc55486@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbd9a837a18ca57ac0d9b4165a6eec95ee132f55d025666fe41099f33@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rc4779abc1cface47e956cf9f8910f15d79c24477e7b1ac9be076a825@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc4dbc9907b0bdd634200ac90a15283d9c143c11af66e7ec72128d020@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036cb67987ad42c1f2dce@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rc907ed7b089828364437de5ed57fa062330970dc1bc5cd214b711f77@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rcdea97f4d3233298296aabc103c9fcefbf629425418c2b69bb16745f@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd0471252aeb3384c3cfa6d131374646d4641b80dd313e7b476c47a9c@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rd24d8a059233167b4a5aebda4b3534ca1d86caa8a85b10a73403ee97@%3Ccommits.spark.apache.org%3E
https://lists.apache.org/thread.html/rd6c1eb9a8a94b3ac8a525d74d792924e8469f201b77e1afcf774e7a6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rd755dfe5f658c42704540ad7950cebd136739089c3231658e398cf38@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rd7c8fb305a8637480dc943ba08424c8992dccad018cd1405eb2afe0e@%3Cdev.ignite.apache.org%3E
https://lists.apache.org/thread.html/rd9ea411a58925cc82c32e15f541ead23cb25b4b2d57a2bdb0341536e@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdbf2a2cd1800540ae50dd78b57411229223a6172117d62b8e57596aa@%3Cissues.hbase.apache.org%3E
https://lists.apache.org/thread.html/rdde34d53aa80193cda016272d61e6749f8a9044ccb37a30768938f7e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f15a8c4212fad89d9f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rdfe5f1c071ba9dadba18d7fb0ff13ea6ecb33da624250c559999eaeb@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/re0545ecced2d468c94ce4dcfa37d40a9573cc68ef5f6839ffca9c1c1@%3Ccommits.hbase.apache.org%3E
https://lists.apache.org/thread.html/re3a1617d16a7367f767b8209b2151f4c19958196354b39568c532f26@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/re577736ca7da51952c910b345a500b7676ea9931c9b19709b87f292b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re6614b4fe7dbb945409daadb9e1cc73c02383df68bf9334736107a6e@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ree1895a256a9db951e0d97a76222909c2e1f28c1a3d89933173deed6@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf1b02dfccd27b8bbc3afd119b212452fa32e9ed7d506be9357a3a7ec@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf6de4c249bd74007f5f66f683c110535f46e719d2f83a41e8faf295f@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rf99f9a25ca24fe519c9346388f61b5b3a09be31b800bf37f01473ad7@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfc9f51b4e21022b3cd6cb6f90791a6a6999560212e519b5f09db0aed@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rfd3ff6e66b6bbcfb2fefa9f5a20328937c0369b2e142e3e1c6774743@%3Creviews.spark.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-28165
https://security.netapp.com/advisory/ntap-20210611-0006/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.eclipse.jetty:jetty-client | CVE-2020-27223 | MEDIUM | 9.4.20.v20190813 | 9.4.36.v20210114, 10.0.1, 11.0.1 |
Expand...https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128
https://github.com/advisories/GHSA-m394-8rww-3jr7
https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7
https://lists.apache.org/thread.html/r068dfd35ce2193f6af28b74ff29ab148c2b2cacb235995576f5bea78@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r07aedcb1ece62969c406cb84c8f0e22cec7e42cdc272f3176e473320@%3Cusers.solr.apache.org%3E
https://lists.apache.org/thread.html/r0b639bd9bfaea265022125d18acd2fc6456044b76609ec74772c9567@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0c6eced465950743f3041b03767a32b2e98d19731bd72277fc7ea428@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0cdab13815fc419805a332278c8d27e354e78560944fc36db0bdc760@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0e25cdf3722a24c53049d37396f0da8502cb4b7cdc481650dc601dbc@%3Cgitbox.activemq.apache.org%3E
https://lists.apache.org/thread.html/r105f4e52feb051faeb9141ef78f909aaf5129d6ed1fc52e099c79463@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r1414ab2b3f4bb4c0e736caff6dc8d15f93f6264f0cca5c47710d7bb3@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r1b7ed296a865e3f1337a96ee9cd51f6d154d881a30da36020ca72a4b@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r1b803e6ebdac5f670708878fb1b27cd7a0ce9d774a60e797e58cee6f@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r26d9196f4d2afb9bec2784bcb6fc183aca82e4119bf41bdc613eec01@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r27ad7843d060762cc942820566eeaa9639f75371afedf8124b943283@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r2c2c7b2971360fb946bbf062c58d7245927dd1ce9150fc9987f65409@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2c947376491a20d1cf143bf3c21ed74113e099d806cfe4c490a45ad8@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/r35ab810c0f3016b3fd3a3fa9088a2d2781b354a810780ce74d022b6c@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3ce0e31b25ad4ee8f7c42b62cfdc72d1b586f5d6accd23f5295b6dd1@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r409ee2bae66bfff6aa89e6c74aff535e6248260d3afcb42bfb3b316b@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r463b12b27264c5e1e3c48c8c2cc5d33813d2f0d981102548fb3102fb@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r492cff8488a7f6eb96700afb5d137b719ddb80a833e77f971d2691c6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4a456d89a83752a012d88a60ff4b21def6c9f650b9e69ea9fa11c9f9@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r4c92ea39167c0f7b096ae8268db496b5451d69606f0304b7c8a994c7@%3Cissues.nifi.apache.org%3E
https://lists.apache.org/thread.html/r51f8975ef47c12a46fbfd7da9efea7f08e1d307fe1dc3042514659ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r521a077885ce79c44a799118c878589e81e525cab72d368e5cfb6f61@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r5612dc69e1f79c421faf9764ffbc92591e2a69ea417c04cba57f49ea@%3Cuser.karaf.apache.org%3E
https://lists.apache.org/thread.html/r562a0cbc5c8cac4d000a27b2854a8ab1b924aa9dd45f8ffbea98e5ad@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r5b7cc6ac733e0b35816751cf45d152ae246a3f40e0b1e62b101c9522@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r601f15f3de7ae3a7bbcd780c19155075c56443c2cdc1d193c03b4182@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/r65c714241b9d064a44fec10d60ebf5a37d5ebadd6bf88b0eed13ade0@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r734f996149bb9b1796740385fcbdf3e093eb9aabedc0f20a48ea1d68@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r75ee2a529edb892ac59110cb3f6f91844a932c5034e16c8317f5668d@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7f4ad5eec0bce2821c308bb23cac53df5c94eb84de1c58de9b95c176@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7fbdb7880be1566f943d80fbbeefde2115c086eba1bef3115350a388@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7ffd050d3bd7c90d95f4933560b5f4f15971ab9a5f5322fdce116243@%3Cdev.lucene.apache.org%3E
https://lists.apache.org/thread.html/r855b24a3bde3674256152edfc53fb8c9000f9b59db3fecbbde33b211@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r857b31ad16c6e76002bc6cca73c83358ed2595477e288286ee82c48d@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r897a6a14d03eab09e89b809d2a650f3765065201da5bc3db9a4dd6e8@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8b1963f16d6cb1230ca7ee73b6ec4f5c48f344191dbb1caabd265ee4@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8dc1b13b80d39fbf4a9d158850e15cd868f0460c2f364f13dca7050b@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra2f529da674f25a7351543544f7d621b5227c49a0745913b1194d11e@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/ra384892bab8c03a60613a6a9d5e9cae0a2b800fd882792a55520115e@%3Ccommits.kafka.apache.org%3E
https://lists.apache.org/thread.html/ra40a88a2301a3da86e25b501ff4bc88124f2b816c2917d5f3497f8f0@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra47a26c008487b0a739a368c846e168de06c3cd118d31ecedafa679a@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/raa6d60b00b67c0550672b4f506f0df75b323dcd25cf574e91e2f2dff@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rb79b62ac3085e05656e41865f5a7efcbdc7dcd7843abed9c5fe0fef8@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc052fd4e9e9c01bead74c0b5680355ea5dc3b72d46f253cb65d03e43@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rc721fe2910533bffb6bd4d69ea8ff4f36066d260dbcd2d14e041614a@%3Cissues.spark.apache.org%3E
https://lists.apache.org/thread.html/rd666e187ebea2fda8624683ab51e2a5ad2108f762d21bf1a383d7502@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/rd8e24a3e482e5984bc8c5492dc790413e4fdc1234e3debb94515796b@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdd6c47321db1bfe12c68a898765bf3b6f97e2afa6a501254ed4feaed@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/re03a4dbc15df6f390a2f8c0a071c31c8324dbef007e59fdc2592091a@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re0d38cc2b5da28f708fc89de49036f3ace052c47a1202f7d70291614@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/re19fa47ec901cc3cf6d7784027198e8113f8bc2dbfd6c9d6d13f5447@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re3bd4f831f9be49871cb6adb997289b5dbcd6fe4bc5cb08223254080@%3Cdev.lucene.apache.org%3E
https://lists.apache.org/thread.html/re43768896273c0b5f1a03d7f0a9d370852074489d51825fdc0d77f0f@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re819198d4732804dc01fca8b5b144689a118ede49f6128968773595c@%3Ccommits.kafka.apache.org%3E
https://lists.apache.org/thread.html/reb3c6dc050c7ee18ea154cd94dba85d99aa6b02b84c4bb2138a4abf2@%3Creviews.spark.apache.org%3E
https://lists.apache.org/thread.html/reca91f217f9e1ce607ce6e19a1c0b3db82b5b1b58cf39a84d6434695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf190d1d28e1367d1664ef6bc2f71227566d7b6b39209817a5364da1f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rf6c2efa3137bc8c22707e550a1f9b80f74bca62b9c8a6f768f2c6b86@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf77f4c4583669f1133d58cc4f1964367e253818ed8db986bb2732f7c@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rff630ce92a4d1bb494fc1a3f9b57a3d60819b436505bcd8c6ccc713c@%3Ccommits.kafka.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-27223
https://security.netapp.com/advisory/ntap-20210401-0005/
https://www.debian.org/security/2021/dsa-4949
https://www.oracle.com/security-alerts/cpuApr2021.html
| @@ -343,7 +336,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/flood/CHANGELOG.md b/docs/apps/stable/flood/CHANGELOG.md index d4254720da4..7887ce40c0e 100644 --- a/docs/apps/stable/flood/CHANGELOG.md +++ b/docs/apps/stable/flood/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [flood-4.0.26](https://github.com/truecharts/apps/compare/flood-4.0.25...flood-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [flood-4.0.25](https://github.com/truecharts/apps/compare/flood-4.0.24...flood-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/flood/index.md b/docs/apps/stable/flood/index.md index e11dc36ba0c..5b96bce45a5 100644 --- a/docs/apps/stable/flood/index.md +++ b/docs/apps/stable/flood/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/flood/security.md b/docs/apps/stable/flood/security.md index e209ab09f69..f94ea18dbb6 100644 --- a/docs/apps/stable/flood/security.md +++ b/docs/apps/stable/flood/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-flood' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-flood' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-flood' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/focalboard/CHANGELOG.md b/docs/apps/stable/focalboard/CHANGELOG.md index 2b8fb07f750..714c72262a3 100644 --- a/docs/apps/stable/focalboard/CHANGELOG.md +++ b/docs/apps/stable/focalboard/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [focalboard-4.0.27](https://github.com/truecharts/apps/compare/focalboard-4.0.26...focalboard-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [focalboard-4.0.26](https://github.com/truecharts/apps/compare/focalboard-4.0.25...focalboard-4.0.26) (2021-12-19) diff --git a/docs/apps/stable/focalboard/index.md b/docs/apps/stable/focalboard/index.md index a29663faee5..010bc647ea5 100644 --- a/docs/apps/stable/focalboard/index.md +++ b/docs/apps/stable/focalboard/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/focalboard/security.md b/docs/apps/stable/focalboard/security.md index ce2cfd5c6f9..f8027ccfa23 100644 --- a/docs/apps/stable/focalboard/security.md +++ b/docs/apps/stable/focalboard/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-focalboard' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-focalboard' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-focalboard' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -125,3 +122,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/tidwall/gjson | CVE-2021-42836 | HIGH | v1.7.3 | v1.9.3 |
Expand...https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944
https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96
https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
https://github.com/tidwall/gjson/issues/236
https://github.com/tidwall/gjson/issues/237
https://nvd.nist.gov/vuln/detail/CVE-2021-42836
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/foldingathome/CHANGELOG.md b/docs/apps/stable/foldingathome/CHANGELOG.md index 6ad5ca85e55..52ae620d4ec 100644 --- a/docs/apps/stable/foldingathome/CHANGELOG.md +++ b/docs/apps/stable/foldingathome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [foldingathome-0.0.8](https://github.com/truecharts/apps/compare/foldingathome-0.0.7...foldingathome-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [foldingathome-0.0.7](https://github.com/truecharts/apps/compare/foldingathome-0.0.6...foldingathome-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/foldingathome/index.md b/docs/apps/stable/foldingathome/index.md index 791b6031f45..4ffe6746599 100644 --- a/docs/apps/stable/foldingathome/index.md +++ b/docs/apps/stable/foldingathome/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/foldingathome/security.md b/docs/apps/stable/foldingathome/security.md index 03727c52fe4..e2dac63d708 100644 --- a/docs/apps/stable/foldingathome/security.md +++ b/docs/apps/stable/foldingathome/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-foldingathome' of Deployment 'RELEASE-NAME-foldingathome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/fossil/CHANGELOG.md b/docs/apps/stable/fossil/CHANGELOG.md index 4399cf66e0c..b061a5f5b64 100644 --- a/docs/apps/stable/fossil/CHANGELOG.md +++ b/docs/apps/stable/fossil/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [fossil-2.0.26](https://github.com/truecharts/apps/compare/fossil-2.0.25...fossil-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [fossil-2.0.25](https://github.com/truecharts/apps/compare/fossil-2.0.24...fossil-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/fossil/index.md b/docs/apps/stable/fossil/index.md index 4c345e1854d..477d083e4b5 100644 --- a/docs/apps/stable/fossil/index.md +++ b/docs/apps/stable/fossil/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/fossil/security.md b/docs/apps/stable/fossil/security.md index 7476cab8d6e..c6d8ec9a89c 100644 --- a/docs/apps/stable/fossil/security.md +++ b/docs/apps/stable/fossil/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-fossil' of Deployment 'RELEASE-NAME-fossil' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/freeradius/CHANGELOG.md b/docs/apps/stable/freeradius/CHANGELOG.md index ccd844018c7..ed4e03a5218 100644 --- a/docs/apps/stable/freeradius/CHANGELOG.md +++ b/docs/apps/stable/freeradius/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [freeradius-4.0.29](https://github.com/truecharts/apps/compare/freeradius-4.0.28...freeradius-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [freeradius-4.0.28](https://github.com/truecharts/apps/compare/freeradius-4.0.27...freeradius-4.0.28) (2021-12-19) diff --git a/docs/apps/stable/freeradius/index.md b/docs/apps/stable/freeradius/index.md index f8f8ab0ee5d..ed02920c636 100644 --- a/docs/apps/stable/freeradius/index.md +++ b/docs/apps/stable/freeradius/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/freeradius/security.md b/docs/apps/stable/freeradius/security.md index d551af36ed1..ff9f90c4f3a 100644 --- a/docs/apps/stable/freeradius/security.md +++ b/docs/apps/stable/freeradius/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freeradius' of Deployment 'RELEASE-NAME-freeradius' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/freshrss/CHANGELOG.md b/docs/apps/stable/freshrss/CHANGELOG.md index 4cbacd90be5..e71f851ed3f 100644 --- a/docs/apps/stable/freshrss/CHANGELOG.md +++ b/docs/apps/stable/freshrss/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [freshrss-9.0.30](https://github.com/truecharts/apps/compare/freshrss-9.0.29...freshrss-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [freshrss-9.0.29](https://github.com/truecharts/apps/compare/freshrss-9.0.28...freshrss-9.0.29) (2021-12-19) diff --git a/docs/apps/stable/freshrss/index.md b/docs/apps/stable/freshrss/index.md index dd296f088d1..16c459c837d 100644 --- a/docs/apps/stable/freshrss/index.md +++ b/docs/apps/stable/freshrss/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/freshrss/security.md b/docs/apps/stable/freshrss/security.md index 88e8198144a..5e41d01ec01 100644 --- a/docs/apps/stable/freshrss/security.md +++ b/docs/apps/stable/freshrss/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-freshrss' of Deployment 'RELEASE-NAME-freshrss' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/friendica/CHANGELOG.md b/docs/apps/stable/friendica/CHANGELOG.md index ef7224ec805..5ff225e3849 100644 --- a/docs/apps/stable/friendica/CHANGELOG.md +++ b/docs/apps/stable/friendica/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [friendica-0.0.18](https://github.com/truecharts/apps/compare/friendica-0.0.17...friendica-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [friendica-0.0.17](https://github.com/truecharts/apps/compare/friendica-0.0.16...friendica-0.0.17) (2021-12-19) diff --git a/docs/apps/stable/friendica/index.md b/docs/apps/stable/friendica/index.md index 52500d091d5..a39048b0ddc 100644 --- a/docs/apps/stable/friendica/index.md +++ b/docs/apps/stable/friendica/index.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/friendica/security.md b/docs/apps/stable/friendica/security.md index efe0f20b2ae..6a6815a159f 100644 --- a/docs/apps/stable/friendica/security.md +++ b/docs/apps/stable/friendica/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,11 +46,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-friendica' of Deployment 'RELEASE-NAME-friendica' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -72,9 +60,9 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/friendica:v2021.09@sha256:5af8766837016690d589a928e800ebd67718a348822e3ecb31e24b45bb6cf8a0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -121,6 +109,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -131,6 +121,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -141,6 +133,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -151,6 +145,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -860,7 +856,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -879,7 +875,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -889,13 +885,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -942,7 +940,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -1076,7 +1078,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** @@ -1278,7 +1280,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/gaps/CHANGELOG.md b/docs/apps/stable/gaps/CHANGELOG.md index 0286c86c05a..fe889deaaa5 100644 --- a/docs/apps/stable/gaps/CHANGELOG.md +++ b/docs/apps/stable/gaps/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gaps-9.0.27](https://github.com/truecharts/apps/compare/gaps-9.0.26...gaps-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gaps-9.0.26](https://github.com/truecharts/apps/compare/gaps-9.0.25...gaps-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/gaps/index.md b/docs/apps/stable/gaps/index.md index 09b01d71df4..0d9258e2c39 100644 --- a/docs/apps/stable/gaps/index.md +++ b/docs/apps/stable/gaps/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/gaps/security.md b/docs/apps/stable/gaps/security.md index a45a1404b5a..eac61dfef23 100644 --- a/docs/apps/stable/gaps/security.md +++ b/docs/apps/stable/gaps/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gaps' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gaps' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gaps' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -214,8 +211,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | ch.qos.logback:logback-core | CVE-2021-42550 | MEDIUM | 1.2.3 | |
Expand...http://logback.qos.ch/news.html
https://github.com/advisories/GHSA-668q-qrv7-99fm
https://github.com/cn-panda/logbackRceDemo
https://github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.html
https://github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359c
https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42
https://jira.qos.ch/browse/LOGBACK-1591
https://nvd.nist.gov/vuln/detail/CVE-2021-42550
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.13.3 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.3 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.13.3 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.13.3 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.13.3 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 9.0.39 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 9.0.39 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25329 | HIGH | 9.0.39 | 7.0.108, 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/2
https://github.com/advisories/GHSA-jgwr-3qm3-26f3
https://github.com/apache/tomcat/commit/6d66e99ef85da93e4d2c2a536ca51aa3418bfaf4
https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25329
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/docs/apps/stable/gitea/CHANGELOG.md b/docs/apps/stable/gitea/CHANGELOG.md index ad8c9d63af9..faaa6a2fbf8 100644 --- a/docs/apps/stable/gitea/CHANGELOG.md +++ b/docs/apps/stable/gitea/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gitea-5.0.20](https://github.com/truecharts/apps/compare/gitea-5.0.19...gitea-5.0.20) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gitea-5.0.19](https://github.com/truecharts/apps/compare/gitea-5.0.18...gitea-5.0.19) (2021-12-19) diff --git a/docs/apps/stable/gitea/index.md b/docs/apps/stable/gitea/index.md index 06f4af19cda..26aaf440893 100644 --- a/docs/apps/stable/gitea/index.md +++ b/docs/apps/stable/gitea/index.md @@ -19,9 +19,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | memcached | 1.0.36 | -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | memcached | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/gitea/security.md b/docs/apps/stable/gitea/security.md index 707bc669428..b8b547ba87e 100644 --- a/docs/apps/stable/gitea/security.md +++ b/docs/apps/stable/gitea/security.md @@ -19,27 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-memcached' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-memcached' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-memcached' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| | Type | Misconfiguration ID | Check | Severity | Explaination | Links | |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -61,11 +54,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -76,11 +64,6 @@ hide: | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container '1-init-directories' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container '2-configure-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -91,20 +74,21 @@ hide: | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gitea' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gitea' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gitea' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7' 'tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7' tccr.io/truecharts/gitea:v1.15.7@sha256:392dd2d31d497e8578f2f915a257789ef2a4193b7a63e336165962415dc1b9d7 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/memcached:v1.6.12@sha256:4bb7e6c427149148fbcd496366700aa348e6a1078f83534de2f897b8790a357a + tccr.io/truecharts/memcached:v1.6.12@sha256:1125ac2a97ea10c4768b349c396aa8e5e12755771d2db76ff94384e390154391 ##### Scan Results @@ -141,7 +125,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -383,10 +367,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -421,7 +404,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -669,7 +652,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/memcached:v1.6.12@sha256:4bb7e6c427149148fbcd496366700aa348e6a1078f83534de2f897b8790a357a (debian 10.11) +#### Container: tccr.io/truecharts/memcached:v1.6.12@sha256:1125ac2a97ea10c4768b349c396aa8e5e12755771d2db76ff94384e390154391 (debian 10.11) **debian** diff --git a/docs/apps/stable/golinks/CHANGELOG.md b/docs/apps/stable/golinks/CHANGELOG.md index f26e23d70c8..5c2d0bb4a82 100644 --- a/docs/apps/stable/golinks/CHANGELOG.md +++ b/docs/apps/stable/golinks/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [golinks-2.0.26](https://github.com/truecharts/apps/compare/golinks-2.0.25...golinks-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [golinks-2.0.25](https://github.com/truecharts/apps/compare/golinks-2.0.24...golinks-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/golinks/index.md b/docs/apps/stable/golinks/index.md index 79e3aa765ec..91a0801abf8 100644 --- a/docs/apps/stable/golinks/index.md +++ b/docs/apps/stable/golinks/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/golinks/security.md b/docs/apps/stable/golinks/security.md index a4534130d1e..ffe98d62f80 100644 --- a/docs/apps/stable/golinks/security.md +++ b/docs/apps/stable/golinks/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-golinks' of Deployment 'RELEASE-NAME-golinks' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/gonic/CHANGELOG.md b/docs/apps/stable/gonic/CHANGELOG.md index fad114800ec..466b8e20764 100644 --- a/docs/apps/stable/gonic/CHANGELOG.md +++ b/docs/apps/stable/gonic/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gonic-4.0.26](https://github.com/truecharts/apps/compare/gonic-4.0.25...gonic-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gonic-4.0.25](https://github.com/truecharts/apps/compare/gonic-4.0.24...gonic-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/gonic/index.md b/docs/apps/stable/gonic/index.md index 75664758b34..63408551ca7 100644 --- a/docs/apps/stable/gonic/index.md +++ b/docs/apps/stable/gonic/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/gonic/security.md b/docs/apps/stable/gonic/security.md index 154d5046a1c..6f0112e0a4d 100644 --- a/docs/apps/stable/gonic/security.md +++ b/docs/apps/stable/gonic/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gonic' of Deployment 'RELEASE-NAME-gonic' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -136,5 +132,7 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/gotify/CHANGELOG.md b/docs/apps/stable/gotify/CHANGELOG.md index f8586071f69..af5c380cdf1 100644 --- a/docs/apps/stable/gotify/CHANGELOG.md +++ b/docs/apps/stable/gotify/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [gotify-5.0.18](https://github.com/truecharts/apps/compare/gotify-5.0.17...gotify-5.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [gotify-5.0.17](https://github.com/truecharts/apps/compare/gotify-5.0.16...gotify-5.0.17) (2021-12-19) diff --git a/docs/apps/stable/gotify/index.md b/docs/apps/stable/gotify/index.md index 71ec0ba8b04..5036e9b11b0 100644 --- a/docs/apps/stable/gotify/index.md +++ b/docs/apps/stable/gotify/index.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/gotify/security.md b/docs/apps/stable/gotify/security.md index efb8d89161e..ec9a8cd76ef 100644 --- a/docs/apps/stable/gotify/security.md +++ b/docs/apps/stable/gotify/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-gotify' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-gotify' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-gotify' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/gotify-server:v2.1.3@sha256:832ee2e12000da56c5778813dd69b60694dcfcea853afac684f12402c89295f4 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -411,10 +402,11 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| github.com/go-yaml/yaml | CVE-2019-11254 | MEDIUM | v2.1.0+incompatible | |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| github.com/go-yaml/yaml | GO-2021-0061 | UNKNOWN | v2.1.0+incompatible | |
Expand...
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -449,7 +441,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/grafana/CHANGELOG.md b/docs/apps/stable/grafana/CHANGELOG.md index ec90bc2c105..4d334ea8ec2 100644 --- a/docs/apps/stable/grafana/CHANGELOG.md +++ b/docs/apps/stable/grafana/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [grafana-2.0.11](https://github.com/truecharts/apps/compare/grafana-2.0.10...grafana-2.0.11) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [grafana-2.0.10](https://github.com/truecharts/apps/compare/grafana-2.0.9...grafana-2.0.10) (2021-12-20) diff --git a/docs/apps/stable/grafana/helm-values.md b/docs/apps/stable/grafana/helm-values.md index 77b08c47f4d..0e9a20cabdf 100644 --- a/docs/apps/stable/grafana/helm-values.md +++ b/docs/apps/stable/grafana/helm-values.md @@ -22,7 +22,7 @@ You will, however, be able to use all values referenced in the common chart here | env.GF_PATHS_PROVISIONING | string | `"/opt/bitnami/grafana/conf/provisioning"` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/grafana"` | | -| image.tag | string | `"v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63"` | | +| image.tag | string | `"v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d"` | | | metrics.enabled | bool | See values.yaml | Enable and configure a Prometheus serviceMonitor for the chart under this key. | | metrics.prometheusRule | object | See values.yaml | Enable and configure Prometheus Rules for the chart under this key. | | metrics.prometheusRule.rules | list | See prometheusrules.yaml | Configure additionial rules for the chart under this key. | diff --git a/docs/apps/stable/grafana/index.md b/docs/apps/stable/grafana/index.md index 17932dcd948..35398c3cd89 100644 --- a/docs/apps/stable/grafana/index.md +++ b/docs/apps/stable/grafana/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/grafana/security.md b/docs/apps/stable/grafana/security.md index d89b48b749c..813783183bb 100644 --- a/docs/apps/stable/grafana/security.md +++ b/docs/apps/stable/grafana/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grafana' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grafana' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-grafana' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/grafana:v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63 + tccr.io/truecharts/grafana:v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/grafana:v8.3.3@sha256:92208b72a61947a965cf52d9e2e876f73fea0ef761ada9b3ba8a7f59e7c31e63 (debian 10.11) +#### Container: tccr.io/truecharts/grafana:v8.3.3@sha256:150b493484b0c883dbaa2e415e3115085f659fd571d0fd380b71d212756f9d4d (debian 10.11) **debian** diff --git a/docs/apps/stable/grav/CHANGELOG.md b/docs/apps/stable/grav/CHANGELOG.md index 2ff2a4f2a59..c4b10720e3e 100644 --- a/docs/apps/stable/grav/CHANGELOG.md +++ b/docs/apps/stable/grav/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [grav-2.0.26](https://github.com/truecharts/apps/compare/grav-2.0.25...grav-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [grav-2.0.25](https://github.com/truecharts/apps/compare/grav-2.0.24...grav-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/grav/index.md b/docs/apps/stable/grav/index.md index 246aa94c6a0..ffcc5baa536 100644 --- a/docs/apps/stable/grav/index.md +++ b/docs/apps/stable/grav/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/grav/security.md b/docs/apps/stable/grav/security.md index 5a0bb449cbf..99d4fddb767 100644 --- a/docs/apps/stable/grav/security.md +++ b/docs/apps/stable/grav/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grav' of Deployment 'RELEASE-NAME-grav' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/grocy/CHANGELOG.md b/docs/apps/stable/grocy/CHANGELOG.md index 37fcd2fb588..9495be6804b 100644 --- a/docs/apps/stable/grocy/CHANGELOG.md +++ b/docs/apps/stable/grocy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [grocy-9.0.27](https://github.com/truecharts/apps/compare/grocy-9.0.26...grocy-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [grocy-9.0.26](https://github.com/truecharts/apps/compare/grocy-9.0.25...grocy-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/grocy/index.md b/docs/apps/stable/grocy/index.md index 8e01167710c..863a46a3ef4 100644 --- a/docs/apps/stable/grocy/index.md +++ b/docs/apps/stable/grocy/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/grocy/security.md b/docs/apps/stable/grocy/security.md index fb2076b0fec..aa269121b6f 100644 --- a/docs/apps/stable/grocy/security.md +++ b/docs/apps/stable/grocy/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -101,4 +97,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| illuminate/view | CVE-2021-43808 | MEDIUM | v8.55.0 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| illuminate/view | CVE-2021-43808 | MEDIUM | v8.55.0 | 8.75.0, 6.20.42, 7.30.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| diff --git a/docs/apps/stable/guacd/CHANGELOG.md b/docs/apps/stable/guacd/CHANGELOG.md index 5f9e0805fb5..aa89e432472 100644 --- a/docs/apps/stable/guacd/CHANGELOG.md +++ b/docs/apps/stable/guacd/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [guacd-0.0.7](https://github.com/truecharts/apps/compare/guacd-0.0.6...guacd-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [guacd-0.0.6](https://github.com/truecharts/apps/compare/guacd-0.0.5...guacd-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/guacd/index.md b/docs/apps/stable/guacd/index.md index 52c8b8b7d58..46820349d72 100644 --- a/docs/apps/stable/guacd/index.md +++ b/docs/apps/stable/guacd/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/guacd/security.md b/docs/apps/stable/guacd/security.md index 0750f82937e..8a9c79a01fd 100644 --- a/docs/apps/stable/guacd/security.md +++ b/docs/apps/stable/guacd/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-guacd' of Deployment 'RELEASE-NAME-guacd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/habridge/CHANGELOG.md b/docs/apps/stable/habridge/CHANGELOG.md index 727d0b4e1f3..894c8588038 100644 --- a/docs/apps/stable/habridge/CHANGELOG.md +++ b/docs/apps/stable/habridge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [habridge-0.0.8](https://github.com/truecharts/apps/compare/habridge-0.0.7...habridge-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [habridge-0.0.7](https://github.com/truecharts/apps/compare/habridge-0.0.6...habridge-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/habridge/index.md b/docs/apps/stable/habridge/index.md index ce153efd742..e5eed52b82d 100644 --- a/docs/apps/stable/habridge/index.md +++ b/docs/apps/stable/habridge/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/habridge/security.md b/docs/apps/stable/habridge/security.md index c72446f837b..27c62df3b6b 100644 --- a/docs/apps/stable/habridge/security.md +++ b/docs/apps/stable/habridge/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-habridge' of Deployment 'RELEASE-NAME-habridge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/handbrake/CHANGELOG.md b/docs/apps/stable/handbrake/CHANGELOG.md index 23bfc9b069b..5d1b27d8352 100644 --- a/docs/apps/stable/handbrake/CHANGELOG.md +++ b/docs/apps/stable/handbrake/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [handbrake-10.0.7](https://github.com/truecharts/apps/compare/handbrake-10.0.6...handbrake-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [handbrake-10.0.6](https://github.com/truecharts/apps/compare/handbrake-10.0.5...handbrake-10.0.6) (2021-12-19) diff --git a/docs/apps/stable/handbrake/index.md b/docs/apps/stable/handbrake/index.md index a020883ea18..ee240a9e01f 100644 --- a/docs/apps/stable/handbrake/index.md +++ b/docs/apps/stable/handbrake/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/handbrake/security.md b/docs/apps/stable/handbrake/security.md index 205b49d2c0e..ac07f1c79ee 100644 --- a/docs/apps/stable/handbrake/security.md +++ b/docs/apps/stable/handbrake/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-handbrake' of Deployment 'RELEASE-NAME-handbrake' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/haste-server/CHANGELOG.md b/docs/apps/stable/haste-server/CHANGELOG.md index 78ff3018fbd..2aaba5a0e48 100644 --- a/docs/apps/stable/haste-server/CHANGELOG.md +++ b/docs/apps/stable/haste-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [haste-server-4.0.26](https://github.com/truecharts/apps/compare/haste-server-4.0.25...haste-server-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [haste-server-4.0.25](https://github.com/truecharts/apps/compare/haste-server-4.0.24...haste-server-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/haste-server/index.md b/docs/apps/stable/haste-server/index.md index 85b251548f7..a571fd3a48a 100644 --- a/docs/apps/stable/haste-server/index.md +++ b/docs/apps/stable/haste-server/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/haste-server/security.md b/docs/apps/stable/haste-server/security.md index f41301954e3..c65c3738316 100644 --- a/docs/apps/stable/haste-server/security.md +++ b/docs/apps/stable/haste-server/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-haste-server' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-haste-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-haste-server' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -182,4 +179,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/headphones/CHANGELOG.md b/docs/apps/stable/headphones/CHANGELOG.md index 3aab26b6798..c37feabb814 100644 --- a/docs/apps/stable/headphones/CHANGELOG.md +++ b/docs/apps/stable/headphones/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [headphones-2.0.26](https://github.com/truecharts/apps/compare/headphones-2.0.25...headphones-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [headphones-2.0.25](https://github.com/truecharts/apps/compare/headphones-2.0.24...headphones-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/headphones/index.md b/docs/apps/stable/headphones/index.md index 11636ddb1de..de50e22f960 100644 --- a/docs/apps/stable/headphones/index.md +++ b/docs/apps/stable/headphones/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/headphones/security.md b/docs/apps/stable/headphones/security.md index 1aa1c31eec6..f00ad000cef 100644 --- a/docs/apps/stable/headphones/security.md +++ b/docs/apps/stable/headphones/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-headphones' of Deployment 'RELEASE-NAME-headphones' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/healthchecks/CHANGELOG.md b/docs/apps/stable/healthchecks/CHANGELOG.md index 3468cde0f64..b8275f52caa 100644 --- a/docs/apps/stable/healthchecks/CHANGELOG.md +++ b/docs/apps/stable/healthchecks/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [healthchecks-5.0.7](https://github.com/truecharts/apps/compare/healthchecks-5.0.6...healthchecks-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [healthchecks-5.0.6](https://github.com/truecharts/apps/compare/healthchecks-5.0.5...healthchecks-5.0.6) (2021-12-19) diff --git a/docs/apps/stable/healthchecks/index.md b/docs/apps/stable/healthchecks/index.md index 096a2e4b7e4..64905404e45 100644 --- a/docs/apps/stable/healthchecks/index.md +++ b/docs/apps/stable/healthchecks/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/healthchecks/security.md b/docs/apps/stable/healthchecks/security.md index 5d9c20ca240..aa65f96c481 100644 --- a/docs/apps/stable/healthchecks/security.md +++ b/docs/apps/stable/healthchecks/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-healthchecks' of Deployment 'RELEASE-NAME-healthchecks' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/hedgedoc/CHANGELOG.md b/docs/apps/stable/hedgedoc/CHANGELOG.md index 51b2bd8d527..02bed4d1222 100644 --- a/docs/apps/stable/hedgedoc/CHANGELOG.md +++ b/docs/apps/stable/hedgedoc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [hedgedoc-0.0.7](https://github.com/truecharts/apps/compare/hedgedoc-0.0.6...hedgedoc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [hedgedoc-0.0.6](https://github.com/truecharts/apps/compare/hedgedoc-0.0.5...hedgedoc-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/hedgedoc/index.md b/docs/apps/stable/hedgedoc/index.md index aae024fe488..1b2510a642b 100644 --- a/docs/apps/stable/hedgedoc/index.md +++ b/docs/apps/stable/hedgedoc/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/hedgedoc/security.md b/docs/apps/stable/hedgedoc/security.md index d6a57a37618..96419a49f6c 100644 --- a/docs/apps/stable/hedgedoc/security.md +++ b/docs/apps/stable/hedgedoc/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,10 +33,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hedgedoc' of Deployment 'RELEASE-NAME-hedgedoc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -54,7 +47,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/hedgedoc:v1.9.2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -226,7 +219,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/heimdall/CHANGELOG.md b/docs/apps/stable/heimdall/CHANGELOG.md index 4ee420ccd9f..2d734e91b22 100644 --- a/docs/apps/stable/heimdall/CHANGELOG.md +++ b/docs/apps/stable/heimdall/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [heimdall-9.0.31](https://github.com/truecharts/apps/compare/heimdall-9.0.30...heimdall-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [heimdall-9.0.30](https://github.com/truecharts/apps/compare/heimdall-9.0.29...heimdall-9.0.30) (2021-12-19) diff --git a/docs/apps/stable/heimdall/index.md b/docs/apps/stable/heimdall/index.md index 11bcd84404f..2520216120b 100644 --- a/docs/apps/stable/heimdall/index.md +++ b/docs/apps/stable/heimdall/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/heimdall/security.md b/docs/apps/stable/heimdall/security.md index 4cc32f81f89..3c54095e3f2 100644 --- a/docs/apps/stable/heimdall/security.md +++ b/docs/apps/stable/heimdall/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-heimdall' of Deployment 'RELEASE-NAME-heimdall' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/home-assistant/CHANGELOG.md b/docs/apps/stable/home-assistant/CHANGELOG.md index 30832e72f1e..f6bffa9a968 100644 --- a/docs/apps/stable/home-assistant/CHANGELOG.md +++ b/docs/apps/stable/home-assistant/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [home-assistant-12.0.22](https://github.com/truecharts/apps/compare/home-assistant-12.0.21...home-assistant-12.0.22) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [home-assistant-12.0.21](https://github.com/truecharts/apps/compare/home-assistant-12.0.20...home-assistant-12.0.21) (2021-12-19) diff --git a/docs/apps/stable/home-assistant/index.md b/docs/apps/stable/home-assistant/index.md index faf10a89cd1..e51a235e793 100644 --- a/docs/apps/stable/home-assistant/index.md +++ b/docs/apps/stable/home-assistant/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/home-assistant/security.md b/docs/apps/stable/home-assistant/security.md index 7e2012a4d67..d717619dc54 100644 --- a/docs/apps/stable/home-assistant/security.md +++ b/docs/apps/stable/home-assistant/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-home-assistant' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-home-assistant' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'init' of Deployment 'RELEASE-NAME-home-assistant' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/home-assistant:v2021.12.3@sha256:aab517cd6a1e0d5fe86db447cfa032b4f9ede1567a60370d3ef4e564fd14576a' tccr.io/truecharts/home-assistant:v2021.12.3@sha256:aab517cd6a1e0d5fe86db447cfa032b4f9ede1567a60370d3ef4e564fd14576a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -454,7 +442,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/htpcmanager/CHANGELOG.md b/docs/apps/stable/htpcmanager/CHANGELOG.md index 2e981c3f000..fbe650d3882 100644 --- a/docs/apps/stable/htpcmanager/CHANGELOG.md +++ b/docs/apps/stable/htpcmanager/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [htpcmanager-0.0.7](https://github.com/truecharts/apps/compare/htpcmanager-0.0.6...htpcmanager-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [htpcmanager-0.0.6](https://github.com/truecharts/apps/compare/htpcmanager-0.0.5...htpcmanager-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/htpcmanager/index.md b/docs/apps/stable/htpcmanager/index.md index 8437be8e9e5..4668ac31153 100644 --- a/docs/apps/stable/htpcmanager/index.md +++ b/docs/apps/stable/htpcmanager/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/htpcmanager/security.md b/docs/apps/stable/htpcmanager/security.md index ad8c6671678..893663a5781 100644 --- a/docs/apps/stable/htpcmanager/security.md +++ b/docs/apps/stable/htpcmanager/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-htpcmanager' of Deployment 'RELEASE-NAME-htpcmanager' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/hyperion-ng/CHANGELOG.md b/docs/apps/stable/hyperion-ng/CHANGELOG.md index fec9d907dd3..f551d0f9837 100644 --- a/docs/apps/stable/hyperion-ng/CHANGELOG.md +++ b/docs/apps/stable/hyperion-ng/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [hyperion-ng-4.0.29](https://github.com/truecharts/apps/compare/hyperion-ng-4.0.28...hyperion-ng-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [hyperion-ng-4.0.28](https://github.com/truecharts/apps/compare/hyperion-ng-4.0.27...hyperion-ng-4.0.28) (2021-12-19) diff --git a/docs/apps/stable/hyperion-ng/index.md b/docs/apps/stable/hyperion-ng/index.md index 35132a827de..411f119e336 100644 --- a/docs/apps/stable/hyperion-ng/index.md +++ b/docs/apps/stable/hyperion-ng/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/hyperion-ng/security.md b/docs/apps/stable/hyperion-ng/security.md index 5f7192cda83..399f35c68b0 100644 --- a/docs/apps/stable/hyperion-ng/security.md +++ b/docs/apps/stable/hyperion-ng/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-hyperion-ng' of Deployment 'RELEASE-NAME-hyperion-ng' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -252,7 +248,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -271,7 +267,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -281,13 +277,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -334,7 +332,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| diff --git a/docs/apps/stable/icantbelieveitsnotvaletudo/CHANGELOG.md b/docs/apps/stable/icantbelieveitsnotvaletudo/CHANGELOG.md index 5ca99d5ff42..e97c1fc7c79 100644 --- a/docs/apps/stable/icantbelieveitsnotvaletudo/CHANGELOG.md +++ b/docs/apps/stable/icantbelieveitsnotvaletudo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [icantbelieveitsnotvaletudo-2.0.26](https://github.com/truecharts/apps/compare/icantbelieveitsnotvaletudo-2.0.25...icantbelieveitsnotvaletudo-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [icantbelieveitsnotvaletudo-2.0.25](https://github.com/truecharts/apps/compare/icantbelieveitsnotvaletudo-2.0.24...icantbelieveitsnotvaletudo-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/icantbelieveitsnotvaletudo/index.md b/docs/apps/stable/icantbelieveitsnotvaletudo/index.md index c438779043c..a9ba6d6993b 100644 --- a/docs/apps/stable/icantbelieveitsnotvaletudo/index.md +++ b/docs/apps/stable/icantbelieveitsnotvaletudo/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/icantbelieveitsnotvaletudo/security.md b/docs/apps/stable/icantbelieveitsnotvaletudo/security.md index 477fd717960..158b882e351 100644 --- a/docs/apps/stable/icantbelieveitsnotvaletudo/security.md +++ b/docs/apps/stable/icantbelieveitsnotvaletudo/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icantbelieveitsnotvaletudo' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-icantbelieveitsnotvaletudo' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/icinga2/CHANGELOG.md b/docs/apps/stable/icinga2/CHANGELOG.md index 54287730ba0..dc7b9d7b90f 100644 --- a/docs/apps/stable/icinga2/CHANGELOG.md +++ b/docs/apps/stable/icinga2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [icinga2-0.0.15](https://github.com/truecharts/apps/compare/icinga2-0.0.14...icinga2-0.0.15) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [icinga2-0.0.14](https://github.com/truecharts/apps/compare/icinga2-0.0.13...icinga2-0.0.14) (2021-12-19) diff --git a/docs/apps/stable/icinga2/index.md b/docs/apps/stable/icinga2/index.md index 9bd78894eac..e34e7f7e3ac 100644 --- a/docs/apps/stable/icinga2/index.md +++ b/docs/apps/stable/icinga2/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/icinga2/security.md b/docs/apps/stable/icinga2/security.md index 44bc9b9bf6a..f9d2c72dba8 100644 --- a/docs/apps/stable/icinga2/security.md +++ b/docs/apps/stable/icinga2/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-icinga2' of Deployment 'RELEASE-NAME-icinga2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/icinga2:v2.13.1@sha256:64116a1e267397888bcd6dd62b428322c81bf925f955867ada5207657a9d79db tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -103,6 +95,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | apache2 | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2 | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -113,6 +107,8 @@ hide: | apache2 | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-bin | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-bin | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -123,6 +119,8 @@ hide: | apache2-bin | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-data | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-data | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -133,6 +131,8 @@ hide: | apache2-data | CVE-2008-0456 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| | apache2-utils | CVE-2021-33193 | HIGH | 2.4.38-3+deb10u6 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33193
https://github.com/apache/httpd/commit/ecebcc035ccd8d0e2984fe41420d9e944f456b3c.patch
https://lists.apache.org/thread.html/re4162adc051c1a0a79e7a24093f3776373e8733abaff57253fef341d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ree7519d71415ecdd170ff1889cab552d71758d2ba2904a17ded21a70@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSM6UWQICBJ2TU727RENU3HBKEAFLT6T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EUVJVRJRBW5QVX4OY3NOHZDQ3B3YOTSG/
https://portswigger.net/research/http2
https://security.netapp.com/advisory/ntap-20210917-0004/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
https://ubuntu.com/security/notices/USN-5090-1
https://www.tenable.com/security/tns-2021-17
| | apache2-utils | CVE-2019-17567 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17567
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-17567
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u6 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u6 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -1387,7 +1387,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/ipfs/CHANGELOG.md b/docs/apps/stable/ipfs/CHANGELOG.md index 079b4421368..71795008acc 100644 --- a/docs/apps/stable/ipfs/CHANGELOG.md +++ b/docs/apps/stable/ipfs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ipfs-0.0.8](https://github.com/truecharts/apps/compare/ipfs-0.0.7...ipfs-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ipfs-0.0.7](https://github.com/truecharts/apps/compare/ipfs-0.0.6...ipfs-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/ipfs/index.md b/docs/apps/stable/ipfs/index.md index d1c6c003f95..7cebf124269 100644 --- a/docs/apps/stable/ipfs/index.md +++ b/docs/apps/stable/ipfs/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/ipfs/security.md b/docs/apps/stable/ipfs/security.md index 79b30072071..cedf586366a 100644 --- a/docs/apps/stable/ipfs/security.md +++ b/docs/apps/stable/ipfs/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ipfs' of Deployment 'RELEASE-NAME-ipfs' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -83,6 +80,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/ipfs/go-ipfs | CVE-2020-26283 | HIGH | v0.7.1-0.20210323141657-684b8b5bb7b0 | v0.8.0 |
Expand...https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
https://github.com/ipfs/go-ipfs/pull/7831
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm
https://nvd.nist.gov/vuln/detail/CVE-2020-26283
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200820211705-5c72a883971a | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/jackett/CHANGELOG.md b/docs/apps/stable/jackett/CHANGELOG.md index 748dec4f4c8..ccb00f38bef 100644 --- a/docs/apps/stable/jackett/CHANGELOG.md +++ b/docs/apps/stable/jackett/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [jackett-9.0.54](https://github.com/truecharts/apps/compare/jackett-9.0.53...jackett-9.0.54) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [jackett-9.0.53](https://github.com/truecharts/apps/compare/jackett-9.0.52...jackett-9.0.53) (2021-12-20) diff --git a/docs/apps/stable/jackett/helm-values.md b/docs/apps/stable/jackett/helm-values.md index 575f0e06a9d..fb57cbd47f8 100644 --- a/docs/apps/stable/jackett/helm-values.md +++ b/docs/apps/stable/jackett/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/jackett"` | | -| image.tag | string | `"v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f"` | | +| image.tag | string | `"v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.path | string | `"/UI/Login"` | | diff --git a/docs/apps/stable/jackett/index.md b/docs/apps/stable/jackett/index.md index 007eb6dc06b..33578500a68 100644 --- a/docs/apps/stable/jackett/index.md +++ b/docs/apps/stable/jackett/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/jackett/security.md b/docs/apps/stable/jackett/security.md index 63f5c2e41be..24f6aafe431 100644 --- a/docs/apps/stable/jackett/security.md +++ b/docs/apps/stable/jackett/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jackett' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jackett' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-jackett' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f + tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:193e7d217e0e92cf8f0ebfb6b0886ebfd6158b7714c8443168dfe861d5bb2a6f (ubuntu 20.04) +#### Container: tccr.io/truecharts/jackett:v0.20.184@sha256:a9c407b4732e85ba34c8b338dafc9e3c26951984506938c919575421fa5c35b2 (ubuntu 20.04) **ubuntu** @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/jdownloader2/CHANGELOG.md b/docs/apps/stable/jdownloader2/CHANGELOG.md index 9b879fa1e57..3c66098d2d8 100644 --- a/docs/apps/stable/jdownloader2/CHANGELOG.md +++ b/docs/apps/stable/jdownloader2/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [jdownloader2-5.0.7](https://github.com/truecharts/apps/compare/jdownloader2-5.0.6...jdownloader2-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [jdownloader2-5.0.6](https://github.com/truecharts/apps/compare/jdownloader2-5.0.5...jdownloader2-5.0.6) (2021-12-19) diff --git a/docs/apps/stable/jdownloader2/index.md b/docs/apps/stable/jdownloader2/index.md index 61a7c1ae4e2..ab121eddd35 100644 --- a/docs/apps/stable/jdownloader2/index.md +++ b/docs/apps/stable/jdownloader2/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/jdownloader2/security.md b/docs/apps/stable/jdownloader2/security.md index 1ab89b9cb34..fd3bd30612f 100644 --- a/docs/apps/stable/jdownloader2/security.md +++ b/docs/apps/stable/jdownloader2/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jdownloader2' of Deployment 'RELEASE-NAME-jdownloader2' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/jellyfin/CHANGELOG.md b/docs/apps/stable/jellyfin/CHANGELOG.md index 859aea39cdd..227f0d41f93 100644 --- a/docs/apps/stable/jellyfin/CHANGELOG.md +++ b/docs/apps/stable/jellyfin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [jellyfin-9.0.27](https://github.com/truecharts/apps/compare/jellyfin-9.0.26...jellyfin-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [jellyfin-9.0.26](https://github.com/truecharts/apps/compare/jellyfin-9.0.25...jellyfin-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/jellyfin/index.md b/docs/apps/stable/jellyfin/index.md index db5308fc00a..9b32199074c 100644 --- a/docs/apps/stable/jellyfin/index.md +++ b/docs/apps/stable/jellyfin/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/jellyfin/security.md b/docs/apps/stable/jellyfin/security.md index 0ae18885354..64cade81d94 100644 --- a/docs/apps/stable/jellyfin/security.md +++ b/docs/apps/stable/jellyfin/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-jellyfin' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-jellyfin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-jellyfin' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/joplin-server/CHANGELOG.md b/docs/apps/stable/joplin-server/CHANGELOG.md index bf82ef18ac4..33c0a710e57 100644 --- a/docs/apps/stable/joplin-server/CHANGELOG.md +++ b/docs/apps/stable/joplin-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [joplin-server-5.0.17](https://github.com/truecharts/apps/compare/joplin-server-5.0.16...joplin-server-5.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [joplin-server-5.0.16](https://github.com/truecharts/apps/compare/joplin-server-5.0.15...joplin-server-5.0.16) (2021-12-19) diff --git a/docs/apps/stable/joplin-server/index.md b/docs/apps/stable/joplin-server/index.md index b8d8a2ae143..e043ca3ff31 100644 --- a/docs/apps/stable/joplin-server/index.md +++ b/docs/apps/stable/joplin-server/index.md @@ -19,8 +19,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/joplin-server/security.md b/docs/apps/stable/joplin-server/security.md index fa8bc5315ac..1a0e0c6130c 100644 --- a/docs/apps/stable/joplin-server/security.md +++ b/docs/apps/stable/joplin-server/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-joplin-server' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-joplin-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/joplin-server:v2.5.1@sha256:a285ff0cf05f534efd28c6652925b57a9774ba41923d15536b873fbbdbabcd2b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -989,7 +979,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.46-5 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-5 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -1004,9 +994,9 @@ hide: | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-5 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-5 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -1018,15 +1008,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-5 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-5 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-5 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-5 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-5 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-5 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1071,7 +1063,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-5 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-5 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-5 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-5 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-5 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -1271,7 +1267,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/kanboard/CHANGELOG.md b/docs/apps/stable/kanboard/CHANGELOG.md index aa710702025..462d82adf99 100644 --- a/docs/apps/stable/kanboard/CHANGELOG.md +++ b/docs/apps/stable/kanboard/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kanboard-5.0.18](https://github.com/truecharts/apps/compare/kanboard-5.0.17...kanboard-5.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kanboard-5.0.17](https://github.com/truecharts/apps/compare/kanboard-5.0.16...kanboard-5.0.17) (2021-12-19) diff --git a/docs/apps/stable/kanboard/index.md b/docs/apps/stable/kanboard/index.md index 1f8b0debebc..7b5d421723c 100644 --- a/docs/apps/stable/kanboard/index.md +++ b/docs/apps/stable/kanboard/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/kanboard/security.md b/docs/apps/stable/kanboard/security.md index 470756e5b3b..6c4ee13581c 100644 --- a/docs/apps/stable/kanboard/security.md +++ b/docs/apps/stable/kanboard/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kanboard' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-kanboard' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/kanboard:v1.2.21@sha256:49f497110c498e0911413082fec4103de068970769874804d6229bd1b0bfec51 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -361,7 +351,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/kms/CHANGELOG.md b/docs/apps/stable/kms/CHANGELOG.md index 11fb6e73d1b..b8685119899 100644 --- a/docs/apps/stable/kms/CHANGELOG.md +++ b/docs/apps/stable/kms/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kms-9.0.31](https://github.com/truecharts/apps/compare/kms-9.0.30...kms-9.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kms-9.0.30](https://github.com/truecharts/apps/compare/kms-9.0.29...kms-9.0.30) (2021-12-19) diff --git a/docs/apps/stable/kms/index.md b/docs/apps/stable/kms/index.md index 5ed49563676..4f6491ffd55 100644 --- a/docs/apps/stable/kms/index.md +++ b/docs/apps/stable/kms/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/kms/security.md b/docs/apps/stable/kms/security.md index 1c12b7a2eca..608caf168e4 100644 --- a/docs/apps/stable/kms/security.md +++ b/docs/apps/stable/kms/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kms' of Deployment 'RELEASE-NAME-kms' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/kodi-headless/CHANGELOG.md b/docs/apps/stable/kodi-headless/CHANGELOG.md index 616da5783c8..a79e78f7c08 100644 --- a/docs/apps/stable/kodi-headless/CHANGELOG.md +++ b/docs/apps/stable/kodi-headless/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [kodi-headless-0.0.8](https://github.com/truecharts/apps/compare/kodi-headless-0.0.7...kodi-headless-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [kodi-headless-0.0.7](https://github.com/truecharts/apps/compare/kodi-headless-0.0.6...kodi-headless-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/kodi-headless/index.md b/docs/apps/stable/kodi-headless/index.md index e52eafda959..24953c9238c 100644 --- a/docs/apps/stable/kodi-headless/index.md +++ b/docs/apps/stable/kodi-headless/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/kodi-headless/security.md b/docs/apps/stable/kodi-headless/security.md index b87897af656..52f1e72930f 100644 --- a/docs/apps/stable/kodi-headless/security.md +++ b/docs/apps/stable/kodi-headless/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-kodi-headless' of Deployment 'RELEASE-NAME-kodi-headless' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/komga/CHANGELOG.md b/docs/apps/stable/komga/CHANGELOG.md index edf73c7e101..573a3011fa1 100644 --- a/docs/apps/stable/komga/CHANGELOG.md +++ b/docs/apps/stable/komga/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [komga-4.0.34](https://github.com/truecharts/apps/compare/komga-4.0.33...komga-4.0.34) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [komga-4.0.33](https://github.com/truecharts/apps/compare/komga-4.0.32...komga-4.0.33) (2021-12-19) diff --git a/docs/apps/stable/komga/index.md b/docs/apps/stable/komga/index.md index b5df4b51345..1e738a29d99 100644 --- a/docs/apps/stable/komga/index.md +++ b/docs/apps/stable/komga/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/komga/security.md b/docs/apps/stable/komga/security.md index 21fb214bdd9..8b01a9bbf8a 100644 --- a/docs/apps/stable/komga/security.md +++ b/docs/apps/stable/komga/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-komga' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-komga' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-komga' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -280,8 +277,8 @@ hide: | org.apache.commons:commons-compress | CVE-2021-35517 | HIGH | 1.20 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/3
http://www.openwall.com/lists/oss-security/2021/07/13/5
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-xqfj-vm6h-2x34
https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46@%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-35517
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.commons:commons-compress | CVE-2021-36090 | HIGH | 1.20 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/4
http://www.openwall.com/lists/oss-security/2021/07/13/6
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-mc84-pj99-q6hh
https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E
https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-36090
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.logging.log4j:log4j-api | CVE-2021-44228 | CRITICAL | 2.14.1 | 2.15.0 |
Expand...http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
http://www.openwall.com/lists/oss-security/2021/12/10/1
http://www.openwall.com/lists/oss-security/2021/12/10/2
http://www.openwall.com/lists/oss-security/2021/12/10/3
http://www.openwall.com/lists/oss-security/2021/12/13/1
http://www.openwall.com/lists/oss-security/2021/12/13/2
http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/apache/logging-log4j2/commit/c77b3cb39312b83b053d23a2158b99ac7de44dd3
https://github.com/apache/logging-log4j2/pull/608
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/tangxiaofeng7/apache-log4j-poc
https://issues.apache.org/jira/browse/LOG4J2-3198
https://issues.apache.org/jira/browse/LOG4J2-3201
https://issues.apache.org/jira/browse/LOG4J2-3214
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/
https://logging.apache.org/log4j/2.x/changes-report.html#a2.15.0
https://logging.apache.org/log4j/2.x/manual/lookups.html#JndiLookup
https://logging.apache.org/log4j/2.x/manual/migration.html
https://logging.apache.org/log4j/2.x/security.html
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
https://nvd.nist.gov/vuln/detail/CVE-2021-44228
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://security.netapp.com/advisory/ntap-20211210-0007/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://twitter.com/kurtseifried/status/1469345530182455296
https://ubuntu.com/security/notices/USN-5192-1
https://ubuntu.com/security/notices/USN-5192-2
https://ubuntu.com/security/notices/USN-5197-1
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell
https://www.debian.org/security/2021/dsa-5020
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.lunasec.io/docs/blog/log4j-zero-day/
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.14.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | LOW | 2.14.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45046 | CRITICAL | 2.14.1 | 2.16.0 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/14/4
http://www.openwall.com/lists/oss-security/2021/12/15/3
http://www.openwall.com/lists/oss-security/2021/12/18/1
https://access.redhat.com/security/cve/CVE-2021-44228
https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
https://github.com/advisories/GHSA-7rjr-3q55-vv33
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://issues.apache.org/jira/browse/LOG4J2-3221
https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45046
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5197-1
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.cve.org/CVERecord?id=CVE-2021-45046
https://www.debian.org/security/2021/dsa-5022
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/14/4
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.14.1 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.pdfbox:pdfbox | CVE-2021-31811 | MEDIUM | 2.0.23 | 2.0.24 |
Expand...http://www.openwall.com/lists/oss-security/2021/06/12/2
https://github.com/advisories/GHSA-fg3j-q579-v8x4
https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e%40%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f71402809baa81548fc20e@%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/rf937c2236e6c79cdb99f76a70690dd345e53dbe0707cb506a202e43e@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/
https://nvd.nist.gov/vuln/detail/CVE-2021-31811
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.pdfbox:pdfbox | CVE-2021-31812 | MEDIUM | 2.0.23 | 2.0.24 |
Expand...http://www.openwall.com/lists/oss-security/2021/06/12/1
https://github.com/advisories/GHSA-7grw-6pjh-jpc9
https://lists.apache.org/thread.html/r132e9dbbe0ebdc08b39583d8be0a575fdba573d60a42d940228bceff@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r143fd8445e0e778f4a85187bd79438630b96b8040e9401751fdb8aea@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r179cc3b6822c167702ab35fe36093d5da4c99af44238c8a754c6860f@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/r2090789e4dcc2c87aacbd87d5f18e2d64dcb9f6eb7c47f5cf7d293cb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e%40%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/ra2ab0ce69ce8aaff0773b8c1036438387ce004c2afc6f066626e205e@%3Cusers.pdfbox.apache.org%3E
https://lists.apache.org/thread.html/rd4b6db6c3b8ab3c70f1c3bbd725a40920896453ffc2744ade6afd9fb@%3Cnotifications.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/re0cacd3fb337cdf8469853913ed2b4ddd8f8bfc52ff0ddbe61c1dfba@%3Ccommits.ofbiz.apache.org%3E
https://lists.apache.org/thread.html/rf251f6c358087107f8c23473468b279d59d50a75db6b4768165c78d3@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rfe26bcaba564deb505c32711ba68df7ec589797dcd96ff3389a8aaba@%3Cnotifications.ofbiz.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7HHWJRFXZ3PTKLJCOM7WJEYZFKFWMNSV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDJKJQOMVFDFIDS27OQJXNOYHV2O273D/
https://nvd.nist.gov/vuln/detail/CVE-2021-31812
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.jgroups:jgroups | CVE-2016-2141 | CRITICAL | 3.6.13.Final | 4.0 |
Expand...http://rhn.redhat.com/errata/RHSA-2016-1435.html
http://rhn.redhat.com/errata/RHSA-2016-1439.html
http://rhn.redhat.com/errata/RHSA-2016-2035.html
http://www.securityfocus.com/bid/91481
http://www.securitytracker.com/id/1036165
https://access.redhat.com/articles/2360521
https://access.redhat.com/errata/RHSA-2016:1345
https://access.redhat.com/errata/RHSA-2016:1346
https://access.redhat.com/errata/RHSA-2016:1347
https://access.redhat.com/errata/RHSA-2016:1374
https://access.redhat.com/errata/RHSA-2016:1376
https://access.redhat.com/errata/RHSA-2016:1389
https://access.redhat.com/errata/RHSA-2016:1432
https://access.redhat.com/errata/RHSA-2016:1433
https://access.redhat.com/errata/RHSA-2016:1434
https://bugzilla.redhat.com/show_bug.cgi?id=1313589
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2141
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2141
https://issues.jboss.org/browse/JGRP-2021
https://lists.apache.org/thread.html/ra18cac97416abc2958db0b107877c31da28d884fa6e70fd89c87384a@%3Cdev.geode.apache.org%3E
https://lists.apache.org/thread.html/rb37cc937d4fc026fb56de4b4ec0d054aa4083c1a4edd0d8360c068a0@%3Cdev.geode.apache.org%3E
https://rhn.redhat.com/errata/RHSA-2016-1328.html
https://rhn.redhat.com/errata/RHSA-2016-1329.html
https://rhn.redhat.com/errata/RHSA-2016-1330.html
https://rhn.redhat.com/errata/RHSA-2016-1331.html
https://rhn.redhat.com/errata/RHSA-2016-1332.html
https://rhn.redhat.com/errata/RHSA-2016-1333.html
https://rhn.redhat.com/errata/RHSA-2016-1334.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
| diff --git a/docs/apps/stable/lazylibrarian/CHANGELOG.md b/docs/apps/stable/lazylibrarian/CHANGELOG.md index 7b17888b56d..1a5d779b3c2 100644 --- a/docs/apps/stable/lazylibrarian/CHANGELOG.md +++ b/docs/apps/stable/lazylibrarian/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [lazylibrarian-9.0.35](https://github.com/truecharts/apps/compare/lazylibrarian-9.0.34...lazylibrarian-9.0.35) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [lazylibrarian-9.0.34](https://github.com/truecharts/apps/compare/lazylibrarian-9.0.33...lazylibrarian-9.0.34) (2021-12-20) diff --git a/docs/apps/stable/lazylibrarian/index.md b/docs/apps/stable/lazylibrarian/index.md index 159466f1ca6..f93a7c87744 100644 --- a/docs/apps/stable/lazylibrarian/index.md +++ b/docs/apps/stable/lazylibrarian/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/lazylibrarian/security.md b/docs/apps/stable/lazylibrarian/security.md index 3485cfeb86f..b485ed1e2ae 100644 --- a/docs/apps/stable/lazylibrarian/security.md +++ b/docs/apps/stable/lazylibrarian/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lazylibrarian' of Deployment 'RELEASE-NAME-lazylibrarian' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/leaf2mqtt/CHANGELOG.md b/docs/apps/stable/leaf2mqtt/CHANGELOG.md index da2b7525d7a..f3c327d7031 100644 --- a/docs/apps/stable/leaf2mqtt/CHANGELOG.md +++ b/docs/apps/stable/leaf2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [leaf2mqtt-2.0.26](https://github.com/truecharts/apps/compare/leaf2mqtt-2.0.25...leaf2mqtt-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [leaf2mqtt-2.0.25](https://github.com/truecharts/apps/compare/leaf2mqtt-2.0.24...leaf2mqtt-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/leaf2mqtt/index.md b/docs/apps/stable/leaf2mqtt/index.md index b9227382934..bb6b13840d6 100644 --- a/docs/apps/stable/leaf2mqtt/index.md +++ b/docs/apps/stable/leaf2mqtt/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/leaf2mqtt/security.md b/docs/apps/stable/leaf2mqtt/security.md index 6323bffb2b9..9350e7d2e36 100644 --- a/docs/apps/stable/leaf2mqtt/security.md +++ b/docs/apps/stable/leaf2mqtt/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leaf2mqtt' of Deployment 'RELEASE-NAME-leaf2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/leantime/CHANGELOG.md b/docs/apps/stable/leantime/CHANGELOG.md index b6a0e3203ac..e90d5cbfc62 100644 --- a/docs/apps/stable/leantime/CHANGELOG.md +++ b/docs/apps/stable/leantime/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [leantime-1.0.4](https://github.com/truecharts/apps/compare/leantime-1.0.3...leantime-1.0.4) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [leantime-1.0.3](https://github.com/truecharts/apps/compare/leantime-1.0.2...leantime-1.0.3) (2021-12-21) diff --git a/docs/apps/stable/leantime/index.md b/docs/apps/stable/leantime/index.md index 556eb5046b4..c8135a58e72 100644 --- a/docs/apps/stable/leantime/index.md +++ b/docs/apps/stable/leantime/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/leantime/security.md b/docs/apps/stable/leantime/security.md index 9c6e72a2f1f..8cced8595ae 100644 --- a/docs/apps/stable/leantime/security.md +++ b/docs/apps/stable/leantime/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-leantime' of Deployment 'RELEASE-NAME-leantime' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/leantime:v2.1.8@sha256:c2a5025fb6019f0fea9d3d8fb37a52f6a91a7d72117a081b759a1d0762dea513 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -246,7 +238,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/libreoffice/CHANGELOG.md b/docs/apps/stable/libreoffice/CHANGELOG.md index 99589d86675..0de1ff9d30a 100644 --- a/docs/apps/stable/libreoffice/CHANGELOG.md +++ b/docs/apps/stable/libreoffice/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [libreoffice-0.0.7](https://github.com/truecharts/apps/compare/libreoffice-0.0.6...libreoffice-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [libreoffice-0.0.6](https://github.com/truecharts/apps/compare/libreoffice-0.0.5...libreoffice-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/libreoffice/index.md b/docs/apps/stable/libreoffice/index.md index 999c1c664ec..4f7ffcc1965 100644 --- a/docs/apps/stable/libreoffice/index.md +++ b/docs/apps/stable/libreoffice/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/libreoffice/security.md b/docs/apps/stable/libreoffice/security.md index 17998263a57..00e9b10f9ea 100644 --- a/docs/apps/stable/libreoffice/security.md +++ b/docs/apps/stable/libreoffice/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-libreoffice' of Deployment 'RELEASE-NAME-libreoffice' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -94,10 +91,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -126,10 +122,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/librespeed/CHANGELOG.md b/docs/apps/stable/librespeed/CHANGELOG.md index 82f93a3508c..7f646b734b9 100644 --- a/docs/apps/stable/librespeed/CHANGELOG.md +++ b/docs/apps/stable/librespeed/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [librespeed-4.0.30](https://github.com/truecharts/apps/compare/librespeed-4.0.29...librespeed-4.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [librespeed-4.0.29](https://github.com/truecharts/apps/compare/librespeed-4.0.28...librespeed-4.0.29) (2021-12-19) diff --git a/docs/apps/stable/librespeed/index.md b/docs/apps/stable/librespeed/index.md index b34d85819c8..352dcc1b678 100644 --- a/docs/apps/stable/librespeed/index.md +++ b/docs/apps/stable/librespeed/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/librespeed/security.md b/docs/apps/stable/librespeed/security.md index 4f4d1d4a187..cd6faaec4e1 100644 --- a/docs/apps/stable/librespeed/security.md +++ b/docs/apps/stable/librespeed/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-librespeed' of Deployment 'RELEASE-NAME-librespeed' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/lidarr/CHANGELOG.md b/docs/apps/stable/lidarr/CHANGELOG.md index f9e57adf20a..552044ad20e 100644 --- a/docs/apps/stable/lidarr/CHANGELOG.md +++ b/docs/apps/stable/lidarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [lidarr-9.0.29](https://github.com/truecharts/apps/compare/lidarr-9.0.28...lidarr-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [lidarr-9.0.28](https://github.com/truecharts/apps/compare/lidarr-9.0.27...lidarr-9.0.28) (2021-12-20) diff --git a/docs/apps/stable/lidarr/helm-values.md b/docs/apps/stable/lidarr/helm-values.md index a97c07524c4..4dfecbf34ee 100644 --- a/docs/apps/stable/lidarr/helm-values.md +++ b/docs/apps/stable/lidarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/lidarr"` | | -| image.tag | string | `"v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444"` | | +| image.tag | string | `"v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/docs/apps/stable/lidarr/index.md b/docs/apps/stable/lidarr/index.md index 52d04015a4f..bec5e2acc52 100644 --- a/docs/apps/stable/lidarr/index.md +++ b/docs/apps/stable/lidarr/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/lidarr/security.md b/docs/apps/stable/lidarr/security.md index bf4f7a94121..574f0400fb2 100644 --- a/docs/apps/stable/lidarr/security.md +++ b/docs/apps/stable/lidarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lidarr' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lidarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-lidarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444 + tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:1b42a728ebc601951969c05792df39d67878b328b818a402f699807c19c5d444 (ubuntu 20.04) +#### Container: tccr.io/truecharts/lidarr:v1.0.0.2385@sha256:cce6c8cf6531583772881c4dacfb9021edac566c15a326722bd695509c31ce5c (ubuntu 20.04) **ubuntu** @@ -395,4 +392,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/littlelink/CHANGELOG.md b/docs/apps/stable/littlelink/CHANGELOG.md index b387b7aab08..728bc5adfef 100644 --- a/docs/apps/stable/littlelink/CHANGELOG.md +++ b/docs/apps/stable/littlelink/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [littlelink-4.0.40](https://github.com/truecharts/apps/compare/littlelink-4.0.39...littlelink-4.0.40) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [littlelink-4.0.39](https://github.com/truecharts/apps/compare/littlelink-4.0.38...littlelink-4.0.39) (2021-12-19) diff --git a/docs/apps/stable/littlelink/index.md b/docs/apps/stable/littlelink/index.md index 50c77fa7d21..894c41c9b1f 100644 --- a/docs/apps/stable/littlelink/index.md +++ b/docs/apps/stable/littlelink/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/littlelink/security.md b/docs/apps/stable/littlelink/security.md index bc3921edb07..2d123b6929e 100644 --- a/docs/apps/stable/littlelink/security.md +++ b/docs/apps/stable/littlelink/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-littlelink' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-littlelink' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-littlelink' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/logitech-media-server/CHANGELOG.md b/docs/apps/stable/logitech-media-server/CHANGELOG.md index 4368f518f58..ff72323c19f 100644 --- a/docs/apps/stable/logitech-media-server/CHANGELOG.md +++ b/docs/apps/stable/logitech-media-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [logitech-media-server-2.0.37](https://github.com/truecharts/apps/compare/logitech-media-server-2.0.36...logitech-media-server-2.0.37) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [logitech-media-server-2.0.36](https://github.com/truecharts/apps/compare/logitech-media-server-2.0.35...logitech-media-server-2.0.36) (2021-12-19) diff --git a/docs/apps/stable/logitech-media-server/index.md b/docs/apps/stable/logitech-media-server/index.md index e26ee2ded9f..6a4e32778fd 100644 --- a/docs/apps/stable/logitech-media-server/index.md +++ b/docs/apps/stable/logitech-media-server/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/logitech-media-server/security.md b/docs/apps/stable/logitech-media-server/security.md index f8e6c18df71..33df0097acf 100644 --- a/docs/apps/stable/logitech-media-server/security.md +++ b/docs/apps/stable/logitech-media-server/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-logitech-media-server' of Deployment 'RELEASE-NAME-logitech-media-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/loki/CHANGELOG.md b/docs/apps/stable/loki/CHANGELOG.md index b90b7c72d1f..1c1d9e8c4bd 100644 --- a/docs/apps/stable/loki/CHANGELOG.md +++ b/docs/apps/stable/loki/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [loki-2.0.14](https://github.com/truecharts/apps/compare/loki-2.0.13...loki-2.0.14) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [loki-2.0.13](https://github.com/truecharts/apps/compare/loki-2.0.12...loki-2.0.13) (2021-12-19) diff --git a/docs/apps/stable/loki/index.md b/docs/apps/stable/loki/index.md index 521c37857d2..7552e04c4bc 100644 --- a/docs/apps/stable/loki/index.md +++ b/docs/apps/stable/loki/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | promtail | 1.0.15 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | promtail | 1.0.17 | ## Installing the Chart diff --git a/docs/apps/stable/loki/security.md b/docs/apps/stable/loki/security.md index 927c5b38fd3..8919dc0024d 100644 --- a/docs/apps/stable/loki/security.md +++ b/docs/apps/stable/loki/security.md @@ -19,11 +19,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promtail' of Deployment 'RELEASE-NAME-promtail' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,15 +32,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-loki' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-loki' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

StatefulSet 'RELEASE-NAME-loki' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/lychee/CHANGELOG.md b/docs/apps/stable/lychee/CHANGELOG.md index d36c3b3859e..02b3e820d71 100644 --- a/docs/apps/stable/lychee/CHANGELOG.md +++ b/docs/apps/stable/lychee/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [lychee-9.0.27](https://github.com/truecharts/apps/compare/lychee-9.0.26...lychee-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [lychee-9.0.26](https://github.com/truecharts/apps/compare/lychee-9.0.25...lychee-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/lychee/index.md b/docs/apps/stable/lychee/index.md index a88ce69a4a8..aff0bc7a129 100644 --- a/docs/apps/stable/lychee/index.md +++ b/docs/apps/stable/lychee/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/lychee/security.md b/docs/apps/stable/lychee/security.md index 3a25dd07dba..38fef79c5fa 100644 --- a/docs/apps/stable/lychee/security.md +++ b/docs/apps/stable/lychee/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-lychee' of Deployment 'RELEASE-NAME-lychee' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -355,5 +351,5 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.42.1 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.42.1 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.2.9 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| diff --git a/docs/apps/stable/mealie/CHANGELOG.md b/docs/apps/stable/mealie/CHANGELOG.md index b35072a5f06..481d95ad11e 100644 --- a/docs/apps/stable/mealie/CHANGELOG.md +++ b/docs/apps/stable/mealie/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mealie-5.0.8](https://github.com/truecharts/apps/compare/mealie-5.0.7...mealie-5.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mealie-5.0.7](https://github.com/truecharts/apps/compare/mealie-5.0.6...mealie-5.0.7) (2021-12-19) diff --git a/docs/apps/stable/mealie/index.md b/docs/apps/stable/mealie/index.md index 8e5dce6742f..acaad27b302 100644 --- a/docs/apps/stable/mealie/index.md +++ b/docs/apps/stable/mealie/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/mealie/security.md b/docs/apps/stable/mealie/security.md index 09e0eee7a35..27a5addef18 100644 --- a/docs/apps/stable/mealie/security.md +++ b/docs/apps/stable/mealie/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mealie' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-mealie' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/mealie:v0.5.4@sha256:fcbbd8328e0eae400813319852e899c4270cc0fde1092d1f4adb6c0d23f02f03 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -464,7 +454,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/medusa/CHANGELOG.md b/docs/apps/stable/medusa/CHANGELOG.md index 1e83ba8f562..d940a4c492c 100644 --- a/docs/apps/stable/medusa/CHANGELOG.md +++ b/docs/apps/stable/medusa/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [medusa-1.0.30](https://github.com/truecharts/apps/compare/medusa-1.0.29...medusa-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [medusa-1.0.29](https://github.com/truecharts/apps/compare/medusa-1.0.28...medusa-1.0.29) (2021-12-19) diff --git a/docs/apps/stable/medusa/index.md b/docs/apps/stable/medusa/index.md index ef88c7a7638..cb2177b2e61 100644 --- a/docs/apps/stable/medusa/index.md +++ b/docs/apps/stable/medusa/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/medusa/security.md b/docs/apps/stable/medusa/security.md index b4e14562bb9..10b6e7d4989 100644 --- a/docs/apps/stable/medusa/security.md +++ b/docs/apps/stable/medusa/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-medusa' of Deployment 'RELEASE-NAME-medusa' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/minetest/CHANGELOG.md b/docs/apps/stable/minetest/CHANGELOG.md index d4702d0d3a0..595d2897236 100644 --- a/docs/apps/stable/minetest/CHANGELOG.md +++ b/docs/apps/stable/minetest/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minetest-0.0.7](https://github.com/truecharts/apps/compare/minetest-0.0.6...minetest-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minetest-0.0.6](https://github.com/truecharts/apps/compare/minetest-0.0.5...minetest-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/minetest/index.md b/docs/apps/stable/minetest/index.md index 035588fff8f..0865b2eeeb2 100644 --- a/docs/apps/stable/minetest/index.md +++ b/docs/apps/stable/minetest/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/minetest/security.md b/docs/apps/stable/minetest/security.md index ad9e619cdb5..5cd3b9fde06 100644 --- a/docs/apps/stable/minetest/security.md +++ b/docs/apps/stable/minetest/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minetest' of Deployment 'RELEASE-NAME-minetest' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/miniflux/CHANGELOG.md b/docs/apps/stable/miniflux/CHANGELOG.md index a1f6cf88e48..9e65b231059 100644 --- a/docs/apps/stable/miniflux/CHANGELOG.md +++ b/docs/apps/stable/miniflux/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [miniflux-4.0.18](https://github.com/truecharts/apps/compare/miniflux-4.0.17...miniflux-4.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [miniflux-4.0.17](https://github.com/truecharts/apps/compare/miniflux-4.0.16...miniflux-4.0.17) (2021-12-19) diff --git a/docs/apps/stable/miniflux/index.md b/docs/apps/stable/miniflux/index.md index 6e252d69c0a..5de696c18f3 100644 --- a/docs/apps/stable/miniflux/index.md +++ b/docs/apps/stable/miniflux/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/miniflux/security.md b/docs/apps/stable/miniflux/security.md index b814fe8ad9f..e2284479d72 100644 --- a/docs/apps/stable/miniflux/security.md +++ b/docs/apps/stable/miniflux/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-miniflux' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-miniflux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-miniflux' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/miniflux:v2.0.34@sha256:38c0a023f8c60eea0b752b7b08170f8bd381ce0effdb406b6945201907edf81b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -331,6 +322,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -365,7 +357,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/minio-console/CHANGELOG.md b/docs/apps/stable/minio-console/CHANGELOG.md index 74f57358b9b..37cf271eecb 100644 --- a/docs/apps/stable/minio-console/CHANGELOG.md +++ b/docs/apps/stable/minio-console/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minio-console-1.0.32](https://github.com/truecharts/apps/compare/minio-console-1.0.31...minio-console-1.0.32) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minio-console-1.0.31](https://github.com/truecharts/apps/compare/minio-console-1.0.30...minio-console-1.0.31) (2021-12-20) diff --git a/docs/apps/stable/minio-console/index.md b/docs/apps/stable/minio-console/index.md index e928dc4ec4a..9950882877f 100644 --- a/docs/apps/stable/minio-console/index.md +++ b/docs/apps/stable/minio-console/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/minio-console/security.md b/docs/apps/stable/minio-console/security.md index c0150eea0b6..7fcfd8a46b7 100644 --- a/docs/apps/stable/minio-console/security.md +++ b/docs/apps/stable/minio-console/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio-console' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio-console' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-minio-console' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -147,5 +144,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| go.mongodb.org/mongo-driver | CVE-2021-20329 | MEDIUM | v1.4.6 | 1.5.1 |
Expand...https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1
https://nvd.nist.gov/vuln/detail/CVE-2021-20329
| diff --git a/docs/apps/stable/minio/CHANGELOG.md b/docs/apps/stable/minio/CHANGELOG.md index 754bb1f8836..2ad42f73377 100644 --- a/docs/apps/stable/minio/CHANGELOG.md +++ b/docs/apps/stable/minio/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minio-1.0.14](https://github.com/truecharts/apps/compare/minio-console-1.0.31...minio-1.0.14) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minio-1.0.13](https://github.com/truecharts/apps/compare/minio-1.0.12...minio-1.0.13) (2021-12-19) diff --git a/docs/apps/stable/minio/index.md b/docs/apps/stable/minio/index.md index 8480509fbff..a9e928aecc7 100644 --- a/docs/apps/stable/minio/index.md +++ b/docs/apps/stable/minio/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/minio/security.md b/docs/apps/stable/minio/security.md index bf930f56b80..0116881755f 100644 --- a/docs/apps/stable/minio/security.md +++ b/docs/apps/stable/minio/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minio' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minio' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-minio' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/minisatip/CHANGELOG.md b/docs/apps/stable/minisatip/CHANGELOG.md index 9def4ad927d..20a01f7426d 100644 --- a/docs/apps/stable/minisatip/CHANGELOG.md +++ b/docs/apps/stable/minisatip/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [minisatip-0.0.8](https://github.com/truecharts/apps/compare/minisatip-0.0.7...minisatip-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [minisatip-0.0.7](https://github.com/truecharts/apps/compare/minisatip-0.0.6...minisatip-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/minisatip/index.md b/docs/apps/stable/minisatip/index.md index 07b2a40b213..e940f47173b 100644 --- a/docs/apps/stable/minisatip/index.md +++ b/docs/apps/stable/minisatip/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/minisatip/security.md b/docs/apps/stable/minisatip/security.md index 922683e7d03..f1d9bf058c3 100644 --- a/docs/apps/stable/minisatip/security.md +++ b/docs/apps/stable/minisatip/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-minisatip' of Deployment 'RELEASE-NAME-minisatip' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/monica/CHANGELOG.md b/docs/apps/stable/monica/CHANGELOG.md index 30b5df4f93d..f1e2a40f520 100644 --- a/docs/apps/stable/monica/CHANGELOG.md +++ b/docs/apps/stable/monica/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [monica-0.0.18](https://github.com/truecharts/apps/compare/monica-0.0.17...monica-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [monica-0.0.17](https://github.com/truecharts/apps/compare/monica-0.0.16...monica-0.0.17) (2021-12-19) diff --git a/docs/apps/stable/monica/index.md b/docs/apps/stable/monica/index.md index 251f0f895a5..40f8d8706c5 100644 --- a/docs/apps/stable/monica/index.md +++ b/docs/apps/stable/monica/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/monica/security.md b/docs/apps/stable/monica/security.md index 10772e553d1..2fbc2d19077 100644 --- a/docs/apps/stable/monica/security.md +++ b/docs/apps/stable/monica/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-monica' of Deployment 'RELEASE-NAME-monica' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/monica:v3.5.0@sha256:db2c8518d1c5c664b8f7cbb86f275739e3c68bff2fc9771a066afe45773dff44 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,6 +93,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -109,6 +103,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -117,6 +113,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -125,6 +123,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -364,7 +364,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -376,7 +376,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -386,15 +386,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -437,7 +439,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -468,7 +474,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | doctrine/dbal | CVE-2021-43608 | CRITICAL | 3.1.3 | 3.0.99, 3.1.4 |
Expand...https://github.com/advisories/GHSA-r7cj-8hjg-x622
https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d
https://github.com/doctrine/dbal/releases
https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622
https://nvd.nist.gov/vuln/detail/CVE-2021-43608
https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html
| -| laravel/framework | CVE-2021-43808 | MEDIUM | v8.68.1 | 8.75.0, 6.20.42, 7.30.6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v8.68.1 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| | symfony/http-kernel | CVE-2021-41267 | MEDIUM | v5.3.10 | 5.3.0, 5.3.12 |
Expand...https://github.com/advisories/GHSA-q3j3-w37x-hq2q
https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
https://github.com/symfony/symfony/pull/44243
https://github.com/symfony/symfony/releases/tag/v5.3.12
https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
https://nvd.nist.gov/vuln/detail/CVE-2021-41267
https://symfony.com/cve-2021-41267
| @@ -504,7 +510,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/mosquitto/CHANGELOG.md b/docs/apps/stable/mosquitto/CHANGELOG.md index 8480e515fec..b0374462be7 100644 --- a/docs/apps/stable/mosquitto/CHANGELOG.md +++ b/docs/apps/stable/mosquitto/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mosquitto-4.0.28](https://github.com/truecharts/apps/compare/mosquitto-4.0.27...mosquitto-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mosquitto-4.0.27](https://github.com/truecharts/apps/compare/mosquitto-4.0.26...mosquitto-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/mosquitto/index.md b/docs/apps/stable/mosquitto/index.md index a14be77c476..9038b6e112d 100644 --- a/docs/apps/stable/mosquitto/index.md +++ b/docs/apps/stable/mosquitto/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/mosquitto/security.md b/docs/apps/stable/mosquitto/security.md index c01c06438b7..8faf7281f06 100644 --- a/docs/apps/stable/mosquitto/security.md +++ b/docs/apps/stable/mosquitto/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mosquitto' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mosquitto' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-mosquitto' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/mstream/CHANGELOG.md b/docs/apps/stable/mstream/CHANGELOG.md index 50fc34ca2e4..09636f46ad6 100644 --- a/docs/apps/stable/mstream/CHANGELOG.md +++ b/docs/apps/stable/mstream/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mstream-1.0.26](https://github.com/truecharts/apps/compare/mstream-1.0.25...mstream-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mstream-1.0.25](https://github.com/truecharts/apps/compare/mstream-1.0.24...mstream-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/mstream/index.md b/docs/apps/stable/mstream/index.md index 36c993a57bb..0658c34bfaa 100644 --- a/docs/apps/stable/mstream/index.md +++ b/docs/apps/stable/mstream/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/mstream/security.md b/docs/apps/stable/mstream/security.md index bc1b98d8ce1..6769913f9b1 100644 --- a/docs/apps/stable/mstream/security.md +++ b/docs/apps/stable/mstream/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mstream' of Deployment 'RELEASE-NAME-mstream' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/muximux/CHANGELOG.md b/docs/apps/stable/muximux/CHANGELOG.md index dda80ba4b5e..ed7249b0918 100644 --- a/docs/apps/stable/muximux/CHANGELOG.md +++ b/docs/apps/stable/muximux/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [muximux-1.0.30](https://github.com/truecharts/apps/compare/muximux-1.0.29...muximux-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [muximux-1.0.29](https://github.com/truecharts/apps/compare/muximux-1.0.28...muximux-1.0.29) (2021-12-19) diff --git a/docs/apps/stable/muximux/index.md b/docs/apps/stable/muximux/index.md index 3359cdaa292..7dca4fa94f0 100644 --- a/docs/apps/stable/muximux/index.md +++ b/docs/apps/stable/muximux/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/muximux/security.md b/docs/apps/stable/muximux/security.md index 3cddd130381..ca0fe761c0d 100644 --- a/docs/apps/stable/muximux/security.md +++ b/docs/apps/stable/muximux/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-muximux' of Deployment 'RELEASE-NAME-muximux' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/mylar/CHANGELOG.md b/docs/apps/stable/mylar/CHANGELOG.md index e6bd0fe36ec..92ba5365877 100644 --- a/docs/apps/stable/mylar/CHANGELOG.md +++ b/docs/apps/stable/mylar/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mylar-4.0.26](https://github.com/truecharts/apps/compare/mylar-4.0.25...mylar-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mylar-4.0.25](https://github.com/truecharts/apps/compare/mylar-4.0.24...mylar-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/mylar/index.md b/docs/apps/stable/mylar/index.md index 4d4e34fb247..f919ca5b67c 100644 --- a/docs/apps/stable/mylar/index.md +++ b/docs/apps/stable/mylar/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/mylar/security.md b/docs/apps/stable/mylar/security.md index 32f3679140b..50db16729be 100644 --- a/docs/apps/stable/mylar/security.md +++ b/docs/apps/stable/mylar/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mylar' of Deployment 'RELEASE-NAME-mylar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/mysql-workbench/CHANGELOG.md b/docs/apps/stable/mysql-workbench/CHANGELOG.md index a5ec9e0b61a..0fc7f190c64 100644 --- a/docs/apps/stable/mysql-workbench/CHANGELOG.md +++ b/docs/apps/stable/mysql-workbench/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [mysql-workbench-0.0.7](https://github.com/truecharts/apps/compare/mysql-workbench-0.0.6...mysql-workbench-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [mysql-workbench-0.0.6](https://github.com/truecharts/apps/compare/mysql-workbench-0.0.5...mysql-workbench-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/mysql-workbench/index.md b/docs/apps/stable/mysql-workbench/index.md index acbec4594f6..931da237e73 100644 --- a/docs/apps/stable/mysql-workbench/index.md +++ b/docs/apps/stable/mysql-workbench/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/mysql-workbench/security.md b/docs/apps/stable/mysql-workbench/security.md index 2082480091f..5b98650351d 100644 --- a/docs/apps/stable/mysql-workbench/security.md +++ b/docs/apps/stable/mysql-workbench/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mysql-workbench' of Deployment 'RELEASE-NAME-mysql-workbench' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -217,3 +214,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/nano-wallet/CHANGELOG.md b/docs/apps/stable/nano-wallet/CHANGELOG.md index 2cc8d7067c5..ffaa532490b 100644 --- a/docs/apps/stable/nano-wallet/CHANGELOG.md +++ b/docs/apps/stable/nano-wallet/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nano-wallet-0.0.9](https://github.com/truecharts/apps/compare/nano-wallet-0.0.8...nano-wallet-0.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nano-wallet-0.0.8](https://github.com/truecharts/apps/compare/nano-wallet-0.0.7...nano-wallet-0.0.8) (2021-12-19) diff --git a/docs/apps/stable/nano-wallet/index.md b/docs/apps/stable/nano-wallet/index.md index 6323bf92810..6013c3d1e64 100644 --- a/docs/apps/stable/nano-wallet/index.md +++ b/docs/apps/stable/nano-wallet/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/nano-wallet/security.md b/docs/apps/stable/nano-wallet/security.md index f75ef23cfe5..029bd098c45 100644 --- a/docs/apps/stable/nano-wallet/security.md +++ b/docs/apps/stable/nano-wallet/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nano-wallet' of Deployment 'RELEASE-NAME-nano-wallet' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/navidrome/CHANGELOG.md b/docs/apps/stable/navidrome/CHANGELOG.md index 31581ba724b..3471073d7aa 100644 --- a/docs/apps/stable/navidrome/CHANGELOG.md +++ b/docs/apps/stable/navidrome/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [navidrome-9.0.27](https://github.com/truecharts/apps/compare/navidrome-9.0.26...navidrome-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [navidrome-9.0.26](https://github.com/truecharts/apps/compare/navidrome-9.0.25...navidrome-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/navidrome/index.md b/docs/apps/stable/navidrome/index.md index 1211687f0a5..cea3a379766 100644 --- a/docs/apps/stable/navidrome/index.md +++ b/docs/apps/stable/navidrome/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/navidrome/security.md b/docs/apps/stable/navidrome/security.md index 7a39ced3fe2..6420b76f2b8 100644 --- a/docs/apps/stable/navidrome/security.md +++ b/docs/apps/stable/navidrome/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-navidrome' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-navidrome' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-navidrome' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -85,5 +82,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/nextcloud/CHANGELOG.md b/docs/apps/stable/nextcloud/CHANGELOG.md index 9244a777e31..6ab723ff5c7 100644 --- a/docs/apps/stable/nextcloud/CHANGELOG.md +++ b/docs/apps/stable/nextcloud/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nextcloud-11.0.8](https://github.com/truecharts/apps/compare/nextcloud-11.0.7...nextcloud-11.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nextcloud-11.0.7](https://github.com/truecharts/apps/compare/nextcloud-11.0.6...nextcloud-11.0.7) (2021-12-19) diff --git a/docs/apps/stable/nextcloud/index.md b/docs/apps/stable/nextcloud/index.md index 513e68acdae..f976190e638 100644 --- a/docs/apps/stable/nextcloud/index.md +++ b/docs/apps/stable/nextcloud/index.md @@ -18,9 +18,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/nextcloud/security.md b/docs/apps/stable/nextcloud/security.md index 36a4ac63af9..9e195a67c4e 100644 --- a/docs/apps/stable/nextcloud/security.md +++ b/docs/apps/stable/nextcloud/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -59,18 +51,10 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-nextcloud' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nextcloud' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nextcloud' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'nextcloud' of CronJob 'RELEASE-NAME-nextcloud-cronjob' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -86,13 +70,13 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/nextcloud:v23.0.0@sha256:08937edce142d8bf675d5b2f8960fe91433fb59b209248f02742c784446d8b59 tccr.io/truecharts/nextcloud:v23.0.0@sha256:08937edce142d8bf675d5b2f8960fe91433fb59b209248f02742c784446d8b59 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -129,7 +113,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -353,6 +337,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -361,6 +347,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -369,6 +357,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -377,6 +367,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -717,7 +709,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -729,7 +721,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -739,15 +731,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -790,7 +784,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -864,6 +862,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -872,6 +872,8 @@ hide: | apache2 | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2 | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2 | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -880,6 +882,8 @@ hide: | apache2-bin | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-bin | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-bin | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -888,6 +892,8 @@ hide: | apache2-data | CVE-2007-1743 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=511
http://marc.info/?l=apache-httpd-dev&m=117511568709063&w=2
http://marc.info/?l=apache-httpd-dev&m=117511834512138&w=2
http://www.securitytracker.com/id?1017904
| | apache2-data | CVE-2007-3303 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://osvdb.org/37050
http://security.psnc.pl/files/apache_report.pdf
http://securityreason.com/securityalert/2814
http://www.securityfocus.com/archive/1/469899/100/0/threaded
http://www.securityfocus.com/archive/1/471832/100/0/threaded
http://www.securityfocus.com/bid/24215
| | apache2-data | CVE-2008-0456 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://rhn.redhat.com/errata/RHSA-2013-0130.html
http://secunia.com/advisories/29348
http://secunia.com/advisories/35074
http://security.gentoo.org/glsa/glsa-200803-19.xml
http://securityreason.com/securityalert/3575
http://securitytracker.com/id?1019256
http://support.apple.com/kb/HT3549
http://www.mindedsecurity.com/MSA01150108.html
http://www.securityfocus.com/archive/1/486847/100/0/threaded
http://www.securityfocus.com/bid/27409
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
http://www.vupen.com/english/advisories/2009/1297
https://exchange.xforce.ibmcloud.com/vulnerabilities/39893
https://linux.oracle.com/cve/CVE-2008-0456.html
https://linux.oracle.com/errata/ELSA-2013-0130.html
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7dd6be4dc38148704f2edafb44a8712abaa3a2be120d6c3314d55919@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r84d043c2115176958562133d96d851495d712aa49da155d81f6733be@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc4c53a0d57b2771ecd4b965010580db355e38137c8711311ee1073a8@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-1~deb11u1 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.51-1~deb11u1 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -1228,7 +1234,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -1240,7 +1246,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -1250,15 +1256,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1301,7 +1309,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -1399,7 +1411,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1647,7 +1659,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/ngircd/CHANGELOG.md b/docs/apps/stable/ngircd/CHANGELOG.md index 521fd4b22d1..369a9232ae8 100644 --- a/docs/apps/stable/ngircd/CHANGELOG.md +++ b/docs/apps/stable/ngircd/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ngircd-0.0.7](https://github.com/truecharts/apps/compare/ngircd-0.0.6...ngircd-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ngircd-0.0.6](https://github.com/truecharts/apps/compare/ngircd-0.0.5...ngircd-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/ngircd/index.md b/docs/apps/stable/ngircd/index.md index 7b87da22329..b0d07a8065a 100644 --- a/docs/apps/stable/ngircd/index.md +++ b/docs/apps/stable/ngircd/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/ngircd/security.md b/docs/apps/stable/ngircd/security.md index 28fc7c6d6e7..8b0ca99f3a8 100644 --- a/docs/apps/stable/ngircd/security.md +++ b/docs/apps/stable/ngircd/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ngircd' of Deployment 'RELEASE-NAME-ngircd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/nntp2nntp/CHANGELOG.md b/docs/apps/stable/nntp2nntp/CHANGELOG.md index 3ec882a3cfe..023dd071b6f 100644 --- a/docs/apps/stable/nntp2nntp/CHANGELOG.md +++ b/docs/apps/stable/nntp2nntp/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nntp2nntp-0.0.7](https://github.com/truecharts/apps/compare/nntp2nntp-0.0.6...nntp2nntp-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nntp2nntp-0.0.6](https://github.com/truecharts/apps/compare/nntp2nntp-0.0.5...nntp2nntp-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/nntp2nntp/index.md b/docs/apps/stable/nntp2nntp/index.md index 24e84f34a29..562422fe426 100644 --- a/docs/apps/stable/nntp2nntp/index.md +++ b/docs/apps/stable/nntp2nntp/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/nntp2nntp/security.md b/docs/apps/stable/nntp2nntp/security.md index 734a183bfe0..14dba0dc0f6 100644 --- a/docs/apps/stable/nntp2nntp/security.md +++ b/docs/apps/stable/nntp2nntp/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nntp2nntp' of Deployment 'RELEASE-NAME-nntp2nntp' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/node-red/CHANGELOG.md b/docs/apps/stable/node-red/CHANGELOG.md index fd6a9644892..924a06b066a 100644 --- a/docs/apps/stable/node-red/CHANGELOG.md +++ b/docs/apps/stable/node-red/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [node-red-9.0.27](https://github.com/truecharts/apps/compare/node-red-9.0.26...node-red-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [node-red-9.0.26](https://github.com/truecharts/apps/compare/node-red-9.0.25...node-red-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/node-red/index.md b/docs/apps/stable/node-red/index.md index e2ab9639f82..b0d0fc453c2 100644 --- a/docs/apps/stable/node-red/index.md +++ b/docs/apps/stable/node-red/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/node-red/security.md b/docs/apps/stable/node-red/security.md index 94ae953aae7..aae48f77769 100644 --- a/docs/apps/stable/node-red/security.md +++ b/docs/apps/stable/node-red/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-node-red' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-node-red' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-node-red' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/novnc/CHANGELOG.md b/docs/apps/stable/novnc/CHANGELOG.md index 1979fc06c2c..03898f11f07 100644 --- a/docs/apps/stable/novnc/CHANGELOG.md +++ b/docs/apps/stable/novnc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [novnc-1.0.26](https://github.com/truecharts/apps/compare/novnc-1.0.25...novnc-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [novnc-1.0.25](https://github.com/truecharts/apps/compare/novnc-1.0.24...novnc-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/novnc/index.md b/docs/apps/stable/novnc/index.md index f11f9de1cb3..5ef0de9c655 100644 --- a/docs/apps/stable/novnc/index.md +++ b/docs/apps/stable/novnc/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/novnc/security.md b/docs/apps/stable/novnc/security.md index d6705460a21..acd1dcb29f5 100644 --- a/docs/apps/stable/novnc/security.md +++ b/docs/apps/stable/novnc/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-novnc' of Deployment 'RELEASE-NAME-novnc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/nullserv/CHANGELOG.md b/docs/apps/stable/nullserv/CHANGELOG.md index d4b9697292d..63bcc4075e1 100644 --- a/docs/apps/stable/nullserv/CHANGELOG.md +++ b/docs/apps/stable/nullserv/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [nullserv-4.0.26](https://github.com/truecharts/apps/compare/nullserv-4.0.25...nullserv-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [nullserv-4.0.25](https://github.com/truecharts/apps/compare/nullserv-4.0.24...nullserv-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/nullserv/index.md b/docs/apps/stable/nullserv/index.md index 4ca086bbb0a..568aada1794 100644 --- a/docs/apps/stable/nullserv/index.md +++ b/docs/apps/stable/nullserv/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/nullserv/security.md b/docs/apps/stable/nullserv/security.md index a71caacfd13..0fdd198adaf 100644 --- a/docs/apps/stable/nullserv/security.md +++ b/docs/apps/stable/nullserv/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nullserv' of Deployment 'RELEASE-NAME-nullserv' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/nzbget/CHANGELOG.md b/docs/apps/stable/nzbget/CHANGELOG.md index 9d269f863a6..c2d2aaef356 100644 --- a/docs/apps/stable/nzbget/CHANGELOG.md +++ b/docs/apps/stable/nzbget/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [nzbget-9.0.27](https://github.com/truecharts/apps/compare/nzbget-9.0.26...nzbget-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [nzbget-9.0.26](https://github.com/truecharts/apps/compare/nzbget-9.0.25...nzbget-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/nzbget/helm-values.md b/docs/apps/stable/nzbget/helm-values.md index 77fd771761c..a287ac48998 100644 --- a/docs/apps/stable/nzbget/helm-values.md +++ b/docs/apps/stable/nzbget/helm-values.md @@ -13,7 +13,7 @@ You will, however, be able to use all values referenced in the common chart here |-----|------|---------|-------------| | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/nzbget"` | | -| image.tag | string | `"v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a"` | | +| image.tag | string | `"v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.enabled | bool | `false` | | diff --git a/docs/apps/stable/nzbget/index.md b/docs/apps/stable/nzbget/index.md index 25ed0343f08..a4e1d86c817 100644 --- a/docs/apps/stable/nzbget/index.md +++ b/docs/apps/stable/nzbget/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/nzbget/security.md b/docs/apps/stable/nzbget/security.md index b751c050617..ca1fa305aad 100644 --- a/docs/apps/stable/nzbget/security.md +++ b/docs/apps/stable/nzbget/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbget' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbget' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-nzbget' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/nzbget:v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a + tccr.io/truecharts/nzbget:v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/nzbget:v21.1@sha256:381d4e760ee2de5b2f3a83d1f2885b3bffe891f6b961db0df94986b03868333a (ubuntu 20.04) +#### Container: tccr.io/truecharts/nzbget:v21.1@sha256:6c33417ef2e13312379b5c8cecfc327092e95b472d85e955156bc402af80a338 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -125,10 +117,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -148,23 +140,26 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| -| wget | CVE-2021-31879 | MEDIUM | 1.20.3-1ubuntu1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31879
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html
https://savannah.gnu.org/bugs/?56909
https://security.netapp.com/advisory/ntap-20210618-0002/
| +| wget | CVE-2021-31879 | MEDIUM | 1.20.3-1ubuntu2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31879
https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html
https://savannah.gnu.org/bugs/?56909
https://security.netapp.com/advisory/ntap-20210618-0002/
| **python-pkg** -| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | -|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| lxml | CVE-2021-43818 | HIGH | 4.6.4 | 4.6.5 |
Expand...https://github.com/advisories/GHSA-55x5-fj6c-h6m8
https://github.com/lxml/lxml/blob/lxml-4.6.5/CHANGES.txt
https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
https://nvd.nist.gov/vuln/detail/CVE-2021-43818
| +| No Vulnerabilities found | +|:---------------------------------| + + **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/nzbhydra/CHANGELOG.md b/docs/apps/stable/nzbhydra/CHANGELOG.md index 60aa677ed1c..c62e6310ce3 100644 --- a/docs/apps/stable/nzbhydra/CHANGELOG.md +++ b/docs/apps/stable/nzbhydra/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [nzbhydra-9.0.30](https://github.com/truecharts/apps/compare/nzbhydra-9.0.29...nzbhydra-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [nzbhydra-9.0.29](https://github.com/truecharts/apps/compare/nzbhydra-9.0.28...nzbhydra-9.0.29) (2021-12-19) diff --git a/docs/apps/stable/nzbhydra/helm-values.md b/docs/apps/stable/nzbhydra/helm-values.md index 23bcd163e7d..5ca79a94f55 100644 --- a/docs/apps/stable/nzbhydra/helm-values.md +++ b/docs/apps/stable/nzbhydra/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/nzbhydra2"` | | -| image.tag | string | `"v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f"` | | +| image.tag | string | `"v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/docs/apps/stable/nzbhydra/index.md b/docs/apps/stable/nzbhydra/index.md index dbcef244a9e..8efe483fd06 100644 --- a/docs/apps/stable/nzbhydra/index.md +++ b/docs/apps/stable/nzbhydra/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/nzbhydra/security.md b/docs/apps/stable/nzbhydra/security.md index 4cabf5de735..35462362869 100644 --- a/docs/apps/stable/nzbhydra/security.md +++ b/docs/apps/stable/nzbhydra/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-nzbhydra' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-nzbhydra' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-nzbhydra' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f + tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:022b1ba5ec2d302162109e634c1a7526e0fb10ffdceaa5044e824fc6e6cd8f4f (ubuntu 20.04) +#### Container: tccr.io/truecharts/nzbhydra2:v3.18.4@sha256:a6068fd5e2491de0feac915d1a8493e4af525eb989ebe40d57da26c4642030b5 (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -118,7 +111,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libjpeg-turbo8 | CVE-2020-17541 | LOW | 2.0.3-0ubuntu1.20.04.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17541
https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
https://linux.oracle.com/cve/CVE-2020-17541.html
https://linux.oracle.com/errata/ELSA-2021-4288.html
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| @@ -131,12 +123,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -154,31 +144,18 @@ hide: | locales | CVE-2021-3326 | LOW | 2.31-0ubuntu9.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/01/28/2
https://bugs.chromium.org/p/project-zero/issues/detail?id=2146
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3326
https://linux.oracle.com/cve/CVE-2021-3326.html
https://linux.oracle.com/errata/ELSA-2021-9344.html
https://security.netapp.com/advisory/ntap-20210304-0007/
https://sourceware.org/bugzilla/show_bug.cgi?id=27256
https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
https://sourceware.org/pipermail/libc-alpha/2021-January/122058.html
| | locales | CVE-2021-33574 | LOW | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| -| openjdk-11-jre-headless | CVE-2021-2341 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2341
https://linux.oracle.com/cve/CVE-2021-2341.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/java/technologies/javase/11-0-12-relnotes.html
https://www.oracle.com/java/technologies/javase/8u301-relnotes.html
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-2369 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2369
https://linux.oracle.com/cve/CVE-2021-2369.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-2388 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2388
https://linux.oracle.com/cve/CVE-2021-2388.html
https://linux.oracle.com/errata/ELSA-2021-2845.html
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html
https://security.netapp.com/advisory/ntap-20210723-0002/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-4946
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35550 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35550
https://linux.oracle.com/cve/CVE-2021-35550.html
https://linux.oracle.com/errata/ELSA-2021-3893.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35556 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35556
https://linux.oracle.com/cve/CVE-2021-35556.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35559 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35559
https://linux.oracle.com/cve/CVE-2021-35559.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35561 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35561
https://linux.oracle.com/cve/CVE-2021-35561.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35564 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35564
https://linux.oracle.com/cve/CVE-2021-35564.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35565 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35565
https://linux.oracle.com/cve/CVE-2021-35565.html
https://linux.oracle.com/errata/ELSA-2021-3893.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35567 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35567
https://linux.oracle.com/cve/CVE-2021-35567.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35578 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35578
https://linux.oracle.com/cve/CVE-2021-35578.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35586 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35586
https://linux.oracle.com/cve/CVE-2021-35586.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| openjdk-11-jre-headless | CVE-2021-35603 | MEDIUM | 11.0.11+9-0ubuntu2~20.04 | 11.0.13+8-0ubuntu1~20.04 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35603
https://linux.oracle.com/cve/CVE-2021-35603.html
https://linux.oracle.com/errata/ELSA-2021-4135.html
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
https://security.netapp.com/advisory/ntap-20211022-0004/
https://ubuntu.com/security/notices/USN-5202-1
https://www.debian.org/security/2021/dsa-5000
https://www.debian.org/security/2021/dsa-5012
https://www.oracle.com/security-alerts/cpuoct2021.html
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/octoprint/CHANGELOG.md b/docs/apps/stable/octoprint/CHANGELOG.md index b2d96643f5e..ca595a86de1 100644 --- a/docs/apps/stable/octoprint/CHANGELOG.md +++ b/docs/apps/stable/octoprint/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [octoprint-4.0.28](https://github.com/truecharts/apps/compare/octoprint-4.0.27...octoprint-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [octoprint-4.0.27](https://github.com/truecharts/apps/compare/octoprint-4.0.26...octoprint-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/octoprint/index.md b/docs/apps/stable/octoprint/index.md index 068f9aaa9f3..8492a0c7f74 100644 --- a/docs/apps/stable/octoprint/index.md +++ b/docs/apps/stable/octoprint/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/octoprint/security.md b/docs/apps/stable/octoprint/security.md index 30d15911234..7941d98f9cb 100644 --- a/docs/apps/stable/octoprint/security.md +++ b/docs/apps/stable/octoprint/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-octoprint' of Deployment 'RELEASE-NAME-octoprint' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -1366,7 +1362,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -1385,7 +1381,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -1395,13 +1391,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -1448,7 +1446,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| diff --git a/docs/apps/stable/odoo/CHANGELOG.md b/docs/apps/stable/odoo/CHANGELOG.md index 3ba85b708e0..e3949a5577b 100644 --- a/docs/apps/stable/odoo/CHANGELOG.md +++ b/docs/apps/stable/odoo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [odoo-4.0.17](https://github.com/truecharts/apps/compare/odoo-4.0.16...odoo-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [odoo-4.0.16](https://github.com/truecharts/apps/compare/odoo-4.0.15...odoo-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/odoo/index.md b/docs/apps/stable/odoo/index.md index 4494533adb8..12cf887ee7f 100644 --- a/docs/apps/stable/odoo/index.md +++ b/docs/apps/stable/odoo/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/odoo/security.md b/docs/apps/stable/odoo/security.md index 418eba6a69a..5e3b53b575e 100644 --- a/docs/apps/stable/odoo/security.md +++ b/docs/apps/stable/odoo/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-odoo' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-odoo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-odoo' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/odoo:version-14.0@sha256:dec23986ced979e029a78512272e2be18bab60d811bccb3d7ddc4b3241b210e2 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -748,7 +739,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/ombi/CHANGELOG.md b/docs/apps/stable/ombi/CHANGELOG.md index c33f892cf9b..3b8b32a73a9 100644 --- a/docs/apps/stable/ombi/CHANGELOG.md +++ b/docs/apps/stable/ombi/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ombi-9.0.29](https://github.com/truecharts/apps/compare/ombi-9.0.28...ombi-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ombi-9.0.28](https://github.com/truecharts/apps/compare/ombi-9.0.27...ombi-9.0.28) (2021-12-19) diff --git a/docs/apps/stable/ombi/index.md b/docs/apps/stable/ombi/index.md index 4aab23908e4..e0c6369e220 100644 --- a/docs/apps/stable/ombi/index.md +++ b/docs/apps/stable/ombi/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/ombi/security.md b/docs/apps/stable/ombi/security.md index bf6bd4268c6..307b8d742ea 100644 --- a/docs/apps/stable/ombi/security.md +++ b/docs/apps/stable/ombi/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ombi' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ombi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-ombi' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/onlyoffice-document-server/CHANGELOG.md b/docs/apps/stable/onlyoffice-document-server/CHANGELOG.md index 2ccab3c2f8c..f02142ad2e6 100644 --- a/docs/apps/stable/onlyoffice-document-server/CHANGELOG.md +++ b/docs/apps/stable/onlyoffice-document-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [onlyoffice-document-server-3.0.7](https://github.com/truecharts/apps/compare/onlyoffice-document-server-3.0.6...onlyoffice-document-server-3.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [onlyoffice-document-server-3.0.6](https://github.com/truecharts/apps/compare/onlyoffice-document-server-3.0.5...onlyoffice-document-server-3.0.6) (2021-12-19) diff --git a/docs/apps/stable/onlyoffice-document-server/index.md b/docs/apps/stable/onlyoffice-document-server/index.md index 7453252e551..c107a982b96 100644 --- a/docs/apps/stable/onlyoffice-document-server/index.md +++ b/docs/apps/stable/onlyoffice-document-server/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/onlyoffice-document-server/security.md b/docs/apps/stable/onlyoffice-document-server/security.md index e7fe51fc532..8c9c63abf6e 100644 --- a/docs/apps/stable/onlyoffice-document-server/security.md +++ b/docs/apps/stable/onlyoffice-document-server/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-onlyoffice-document-server' of Deployment 'RELEASE-NAME-onlyoffice-document-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/openkm/CHANGELOG.md b/docs/apps/stable/openkm/CHANGELOG.md index a5ab1a77ac9..505c3d445f7 100644 --- a/docs/apps/stable/openkm/CHANGELOG.md +++ b/docs/apps/stable/openkm/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openkm-4.0.17](https://github.com/truecharts/apps/compare/openkm-4.0.16...openkm-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openkm-4.0.16](https://github.com/truecharts/apps/compare/openkm-4.0.15...openkm-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/openkm/index.md b/docs/apps/stable/openkm/index.md index 4c2803ae8b8..6004155181a 100644 --- a/docs/apps/stable/openkm/index.md +++ b/docs/apps/stable/openkm/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/openkm/security.md b/docs/apps/stable/openkm/security.md index 9508eaf56fb..e3fa99d3128 100644 --- a/docs/apps/stable/openkm/security.md +++ b/docs/apps/stable/openkm/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-openkm' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openkm' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'init' of Deployment 'RELEASE-NAME-openkm' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 'tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c' tccr.io/truecharts/openkm-ce:v6.3.11@sha256:941156f70c16350fb92d66f60007ac68abaee11265448eaacc40e821a46afc4d tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -973,7 +961,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/openldap/CHANGELOG.md b/docs/apps/stable/openldap/CHANGELOG.md index ca01251aad1..88e3af50d99 100644 --- a/docs/apps/stable/openldap/CHANGELOG.md +++ b/docs/apps/stable/openldap/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openldap-5.0.9](https://github.com/truecharts/apps/compare/openldap-5.0.8...openldap-5.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openldap-5.0.8](https://github.com/truecharts/apps/compare/openldap-5.0.7...openldap-5.0.8) (2021-12-19) diff --git a/docs/apps/stable/openldap/index.md b/docs/apps/stable/openldap/index.md index f27ffd82cb3..fc22803e0b5 100644 --- a/docs/apps/stable/openldap/index.md +++ b/docs/apps/stable/openldap/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/openldap/security.md b/docs/apps/stable/openldap/security.md index 321fb6f7404..c5492f55cee 100644 --- a/docs/apps/stable/openldap/security.md +++ b/docs/apps/stable/openldap/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openldap' of StatefulSet 'RELEASE-NAME-openldap' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -449,6 +445,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20201012173705-84dcc777aaee | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -456,3 +453,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20201012173705-84dcc777aaee | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/openvscode-server/CHANGELOG.md b/docs/apps/stable/openvscode-server/CHANGELOG.md index 9eaa0c3b756..a9ff006349d 100644 --- a/docs/apps/stable/openvscode-server/CHANGELOG.md +++ b/docs/apps/stable/openvscode-server/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [openvscode-server-0.0.8](https://github.com/truecharts/apps/compare/openvscode-server-0.0.7...openvscode-server-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [openvscode-server-0.0.7](https://github.com/truecharts/apps/compare/openvscode-server-0.0.6...openvscode-server-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/openvscode-server/index.md b/docs/apps/stable/openvscode-server/index.md index abd1dd4a8eb..8e0b600e8fa 100644 --- a/docs/apps/stable/openvscode-server/index.md +++ b/docs/apps/stable/openvscode-server/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/openvscode-server/security.md b/docs/apps/stable/openvscode-server/security.md index d5fd264adc7..e4036c93dde 100644 --- a/docs/apps/stable/openvscode-server/security.md +++ b/docs/apps/stable/openvscode-server/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-openvscode-server' of Deployment 'RELEASE-NAME-openvscode-server' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/organizr/CHANGELOG.md b/docs/apps/stable/organizr/CHANGELOG.md index 64d19de4e7d..61d6d985ffe 100644 --- a/docs/apps/stable/organizr/CHANGELOG.md +++ b/docs/apps/stable/organizr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [organizr-9.0.27](https://github.com/truecharts/apps/compare/organizr-9.0.26...organizr-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [organizr-9.0.26](https://github.com/truecharts/apps/compare/organizr-9.0.25...organizr-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/organizr/index.md b/docs/apps/stable/organizr/index.md index 6bbc3af93e8..c35651271c5 100644 --- a/docs/apps/stable/organizr/index.md +++ b/docs/apps/stable/organizr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/organizr/security.md b/docs/apps/stable/organizr/security.md index 4c26e0e4c25..5d7902f75e2 100644 --- a/docs/apps/stable/organizr/security.md +++ b/docs/apps/stable/organizr/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-organizr' of Deployment 'RELEASE-NAME-organizr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -82,6 +78,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.51-r0 | 2.4.52-r0 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.51-r0 | 2.4.52-r0 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| | busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| | busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://ubuntu.com/security/notices/USN-5179-1
| diff --git a/docs/apps/stable/oscam/CHANGELOG.md b/docs/apps/stable/oscam/CHANGELOG.md index 14bc2365d84..32b34f447f7 100644 --- a/docs/apps/stable/oscam/CHANGELOG.md +++ b/docs/apps/stable/oscam/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [oscam-4.0.26](https://github.com/truecharts/apps/compare/oscam-4.0.25...oscam-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [oscam-4.0.25](https://github.com/truecharts/apps/compare/oscam-4.0.24...oscam-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/oscam/index.md b/docs/apps/stable/oscam/index.md index 9133c12b77c..23821c6d005 100644 --- a/docs/apps/stable/oscam/index.md +++ b/docs/apps/stable/oscam/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/oscam/security.md b/docs/apps/stable/oscam/security.md index 93b3b5c5bbf..fc038cc48be 100644 --- a/docs/apps/stable/oscam/security.md +++ b/docs/apps/stable/oscam/security.md @@ -20,15 +20,12 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-oscam' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-oscam' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-oscam' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/overseerr/CHANGELOG.md b/docs/apps/stable/overseerr/CHANGELOG.md index 06ed52045f5..a37077aef05 100644 --- a/docs/apps/stable/overseerr/CHANGELOG.md +++ b/docs/apps/stable/overseerr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [overseerr-4.0.26](https://github.com/truecharts/apps/compare/overseerr-4.0.25...overseerr-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [overseerr-4.0.25](https://github.com/truecharts/apps/compare/overseerr-4.0.24...overseerr-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/overseerr/index.md b/docs/apps/stable/overseerr/index.md index 1b8e99da094..92b6aeff8f9 100644 --- a/docs/apps/stable/overseerr/index.md +++ b/docs/apps/stable/overseerr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/overseerr/security.md b/docs/apps/stable/overseerr/security.md index 67ea9b1fa26..be945c20736 100644 --- a/docs/apps/stable/overseerr/security.md +++ b/docs/apps/stable/overseerr/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-overseerr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/owncast/CHANGELOG.md b/docs/apps/stable/owncast/CHANGELOG.md index 15b599c2f06..c47fa8361e0 100644 --- a/docs/apps/stable/owncast/CHANGELOG.md +++ b/docs/apps/stable/owncast/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [owncast-4.0.26](https://github.com/truecharts/apps/compare/owncast-4.0.25...owncast-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [owncast-4.0.25](https://github.com/truecharts/apps/compare/owncast-4.0.24...owncast-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/owncast/index.md b/docs/apps/stable/owncast/index.md index 267dca07d68..911a93edb6e 100644 --- a/docs/apps/stable/owncast/index.md +++ b/docs/apps/stable/owncast/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/owncast/security.md b/docs/apps/stable/owncast/security.md index d661fe8daeb..2f44e22c2f8 100644 --- a/docs/apps/stable/owncast/security.md +++ b/docs/apps/stable/owncast/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncast' of Deployment 'RELEASE-NAME-owncast' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/owncloud-ocis/CHANGELOG.md b/docs/apps/stable/owncloud-ocis/CHANGELOG.md index 38c2bf499b0..32b11557825 100644 --- a/docs/apps/stable/owncloud-ocis/CHANGELOG.md +++ b/docs/apps/stable/owncloud-ocis/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [owncloud-ocis-4.0.28](https://github.com/truecharts/apps/compare/owncloud-ocis-4.0.27...owncloud-ocis-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [owncloud-ocis-4.0.27](https://github.com/truecharts/apps/compare/owncloud-ocis-4.0.26...owncloud-ocis-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/owncloud-ocis/index.md b/docs/apps/stable/owncloud-ocis/index.md index ed9f8fcb5c3..af65a24ad21 100644 --- a/docs/apps/stable/owncloud-ocis/index.md +++ b/docs/apps/stable/owncloud-ocis/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/owncloud-ocis/security.md b/docs/apps/stable/owncloud-ocis/security.md index 2faf71db39d..41220af4819 100644 --- a/docs/apps/stable/owncloud-ocis/security.md +++ b/docs/apps/stable/owncloud-ocis/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-owncloud-ocis' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-owncloud-ocis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-owncloud-ocis' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -89,4 +86,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| diff --git a/docs/apps/stable/paperless-ng/CHANGELOG.md b/docs/apps/stable/paperless-ng/CHANGELOG.md index 394e7e592b0..f46f6a6b2d7 100644 --- a/docs/apps/stable/paperless-ng/CHANGELOG.md +++ b/docs/apps/stable/paperless-ng/CHANGELOG.md @@ -1,6 +1,19 @@ # Changelog
+ +### [paperless-ng-1.0.5](https://github.com/truecharts/apps/compare/paperless-ng-1.0.4...paperless-ng-1.0.5) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + +#### Fix + +* fix redis URL and use default paths ([#1560](https://github.com/truecharts/apps/issues/1560)) + + + ### [paperless-ng-1.0.4](https://github.com/truecharts/apps/compare/paperless-ng-1.0.3...paperless-ng-1.0.4) (2021-12-19) diff --git a/docs/apps/stable/paperless-ng/helm-values.md b/docs/apps/stable/paperless-ng/helm-values.md index dbf701293c5..79beda0e76e 100644 --- a/docs/apps/stable/paperless-ng/helm-values.md +++ b/docs/apps/stable/paperless-ng/helm-values.md @@ -12,7 +12,7 @@ You will, however, be able to use all values referenced in the common chart here | Key | Type | Default | Description | |-----|------|---------|-------------| | env.PAPERLESS_CONSUMPTION_DIR | string | `"/consume/"` | | -| env.PAPERLESS_DATA_DIR | string | `"/config/"` | | +| env.PAPERLESS_DATA_DIR | string | `"/data/"` | | | env.PAPERLESS_DBNAME | string | `"{{ .Values.postgresql.postgresqlDatabase }}"` | | | env.PAPERLESS_DBPORT | string | `"5432"` | | | env.PAPERLESS_DBUSER | string | `"{{ .Values.postgresql.postgresqlUsername }}"` | | @@ -20,7 +20,7 @@ You will, however, be able to use all values referenced in the common chart here | env.PAPERLESS_STATICDIR | string | `"/static/"` | | | env.PAPERLESS_TIME_ZONE | string | `"{{ .Values.env.TZ }}"` | | | env.PUID | int | `568` | | -| env.USERMAP_GID | string | `"{{ .Values.env.PGID }}"` | | +| env.USERMAP_GID | string | `"{{ .Values.podSecurityContext.fsGroup }}"` | | | env.USERMAP_UID | string | `"{{ .Values.env.PUID }}"` | | | envValueFrom.PAPERLESS_DBHOST.secretKeyRef.key | string | `"plainhost"` | | | envValueFrom.PAPERLESS_DBHOST.secretKeyRef.name | string | `"dbcreds"` | | @@ -33,10 +33,10 @@ You will, however, be able to use all values referenced in the common chart here | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/paperless-ng"` | | | image.tag | string | `"v1.5.0@sha256:94b00a3fb7e829a6a86d8bfd01abd558d20286976501716b6148a504e6544e3a"` | | -| persistence.config.enabled | bool | `true` | | -| persistence.config.mountPath | string | `"/config"` | | | persistence.consume.enabled | bool | `true` | | | persistence.consume.mountPath | string | `"/consume"` | | +| persistence.data.enabled | bool | `true` | | +| persistence.data.mountPath | string | `"/data"` | | | persistence.media.enabled | bool | `true` | | | persistence.media.mountPath | string | `"/media"` | | | persistence.static.enabled | bool | `true` | | @@ -49,7 +49,7 @@ You will, however, be able to use all values referenced in the common chart here | postgresql.postgresqlUsername | string | `"paperless-ng"` | | | redis.enabled | bool | `true` | | | redis.existingSecret | string | `"rediscreds"` | | -| redis.redisUsername | string | `"paperless-ng"` | | +| redis.redisUsername | string | `"default"` | | | secret.PAPERLESS_ADMIN_MAIL | string | `"admin@admin.com"` | | | secret.PAPERLESS_ADMIN_PASSWORD | string | `"admin"` | | | secret.PAPERLESS_ADMIN_USER | string | `"admin"` | | diff --git a/docs/apps/stable/paperless-ng/index.md b/docs/apps/stable/paperless-ng/index.md index 582734b90af..d9f4c87398f 100644 --- a/docs/apps/stable/paperless-ng/index.md +++ b/docs/apps/stable/paperless-ng/index.md @@ -17,9 +17,9 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/paperless-ng/security.md b/docs/apps/stable/paperless-ng/security.md index 0919c1f1fb7..4fb7da6f582 100644 --- a/docs/apps/stable/paperless-ng/security.md +++ b/docs/apps/stable/paperless-ng/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,12 +32,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,15 +48,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-paperless-ng' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-paperless-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -78,12 +64,12 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/paperless-ng:v1.5.0@sha256:94b00a3fb7e829a6a86d8bfd01abd558d20286976501716b6148a504e6544e3a tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -120,7 +106,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -682,7 +668,7 @@ hide: | linux-libc-dev | CVE-2021-40490 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40490
https://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4.git/commit/?id=9e445093e523f3277081314c864f708fd4bd34aa
https://linux.oracle.com/cve/CVE-2021-40490.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6VS2DLGT7TK7URKAS2KWJL3S533SGVA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJGX3DMJT6MRBW2XEF3TWVHYWZW3DG3N/
https://lore.kernel.org/linux-ext4/000000000000e5080305c9e51453@google.com/
https://security.netapp.com/advisory/ntap-20211004-0001/
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://ubuntu.com/security/notices/USN-5120-1
https://www.debian.org/security/2021/dsa-4978
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| | linux-libc-dev | CVE-2021-41073 | HIGH | 5.10.46-4 | 5.10.46-5 |
Expand...http://www.openwall.com/lists/oss-security/2021/09/18/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41073
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J7KSMIOQ4377CVTHMWNGNCWHMCRFRP2T/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAP4TXEZ7J4EZQMQW5SIJMWXG7WZT3F7/
https://security.netapp.com/advisory/ntap-20211014-0003/
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5106-1
https://www.debian.org/security/2021/dsa-4978
https://www.openwall.com/lists/oss-security/2021/09/18/2
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-42008 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42008
https://git.kernel.org/linus/19d1532a187669ce86d5a2696eb7275310070793 (5.14-rc7)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://security.netapp.com/advisory/ntap-20211104-0002/
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.youtube.com/watch?v=d5f9xLK8Vhw
| | linux-libc-dev | CVE-2021-42252 | HIGH | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42252
https://git.kernel.org/linus/b49a0e69a7b1a68c8d3f64097d06dabb770fec96 (5.15-rc1)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b49a0e69a7b1a68c8d3f64097d06dabb770fec96
https://security.netapp.com/advisory/ntap-20211112-0006/
https://ubuntu.com/security/notices/USN-5136-1
https://ubuntu.com/security/notices/USN-5137-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.46-4 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| @@ -698,9 +684,9 @@ hide: | linux-libc-dev | CVE-2020-26541 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26541
https://linux.oracle.com/cve/CVE-2020-26541.html
https://linux.oracle.com/errata/ELSA-2021-2570.html
https://lkml.org/lkml/2020/9/15/1871
https://lore.kernel.org/lkml/161428671215.677100.6372209948022011988.stgit@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/1884195.1615482306@warthog.procyon.org.uk/
https://lore.kernel.org/lkml/20200916004927.64276-1-eric.snowberg@oracle.com/
https://lore.kernel.org/lkml/20210122181054.32635-1-eric.snowberg@oracle.com/
https://ubuntu.com/security/notices/USN-5070-1
https://ubuntu.com/security/notices/USN-5106-1
https://ubuntu.com/security/notices/USN-5120-1
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.46-4 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| | linux-libc-dev | CVE-2020-3702 | MEDIUM | 5.10.46-4 | 5.10.46-5 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3702
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/linux-wireless/CABvG-CVvPF++0vuGzCrBj8+s=Bcx1GwWfiW1_Somu_GVncTAcQ@mail.gmail.com/
https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#mf8b430d4f19f1b939a29b6c5098fdc514fd1a928
https://ubuntu.com/security/notices/USN-5113-1
https://ubuntu.com/security/notices/USN-5114-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
https://www.arista.com/en/support/advisories-notices/security-advisories/11998-security-advisory-58
https://www.debian.org/security/2021/dsa-4978
https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
| -| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| +| linux-libc-dev | CVE-2021-0920 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-0920
https://git.kernel.org/linus/cbcf01128d0a92e131bd09f1688fe032480b65ca
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cbcf01128d0a92e131bd09f1688fe032480b65ca
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://source.android.com/security/bulletin/2021-11-01
| | linux-libc-dev | CVE-2021-20320 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://lore.kernel.org/bpf/20210902185229.1840281-1-johan.almbladh@anyfinetworks.com/
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-34866 | MEDIUM | 5.10.46-4 | 5.10.70-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34866
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b029a32cfe4600f5e10e36b41778506b90fd4de
https://www.zerodayinitiative.com/advisories/ZDI-21-1148/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -717,15 +703,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.46-4 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.46-4 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.46-4 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.46-4 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.46-4 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.46-4 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -771,7 +759,11 @@ hide: | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.46-4 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| | linux-libc-dev | CVE-2021-38204 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38204
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://github.com/torvalds/linux/commit/b5fdf5c6e6bee35837e160c00ac89327bdad031b
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5091-1
https://ubuntu.com/security/notices/USN-5091-2
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
| | linux-libc-dev | CVE-2021-38205 | LOW | 5.10.46-4 | 5.10.70-1 |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38205
https://github.com/torvalds/linux/commit/d0d62baa7f505bd4c59cd169692ff07ec49dde37
https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://ubuntu.com/security/notices/USN-5092-1
https://ubuntu.com/security/notices/USN-5092-2
https://ubuntu.com/security/notices/USN-5094-1
https://ubuntu.com/security/notices/USN-5094-2
https://ubuntu.com/security/notices/USN-5096-1
https://ubuntu.com/security/notices/USN-5115-1
https://ubuntu.com/security/notices/USN-5116-1
https://ubuntu.com/security/notices/USN-5116-2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.46-4 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.46-4 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.46-4 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| @@ -842,7 +834,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1090,7 +1082,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/papermerge/CHANGELOG.md b/docs/apps/stable/papermerge/CHANGELOG.md index 8c8884392a6..309b1467fe4 100644 --- a/docs/apps/stable/papermerge/CHANGELOG.md +++ b/docs/apps/stable/papermerge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [papermerge-0.0.8](https://github.com/truecharts/apps/compare/papermerge-0.0.7...papermerge-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [papermerge-0.0.7](https://github.com/truecharts/apps/compare/papermerge-0.0.6...papermerge-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/papermerge/index.md b/docs/apps/stable/papermerge/index.md index c7cbb04846f..3976ef3be34 100644 --- a/docs/apps/stable/papermerge/index.md +++ b/docs/apps/stable/papermerge/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | -| https://truecharts.org | redis | 1.0.39 | +| https://truecharts.org | common | 8.9.25 | +| https://truecharts.org | redis | 1.0.42 | ## Installing the Chart diff --git a/docs/apps/stable/papermerge/security.md b/docs/apps/stable/papermerge/security.md index 1d8868cfa10..872b0951cce 100644 --- a/docs/apps/stable/papermerge/security.md +++ b/docs/apps/stable/papermerge/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-redis' of StatefulSet 'RELEASE-NAME-redis' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,11 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-papermerge' of Deployment 'RELEASE-NAME-papermerge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -55,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/papermerge:v2.0.1 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c + tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b ##### Scan Results @@ -307,7 +300,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:7a9857fa3f8626b7fd1cbbafaff00dea68a08a30973284c98f232c0168a75b5c (debian 10.11) +#### Container: tccr.io/truecharts/redis:v6.2.6@sha256:8c8360494a9ac357f934f25cd3eecc1ff02f256e0711f5655d16f4737f52512b (debian 10.11) **debian** diff --git a/docs/apps/stable/pgadmin/CHANGELOG.md b/docs/apps/stable/pgadmin/CHANGELOG.md index f3a52b534c1..8a1d26afed5 100644 --- a/docs/apps/stable/pgadmin/CHANGELOG.md +++ b/docs/apps/stable/pgadmin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pgadmin-5.0.8](https://github.com/truecharts/apps/compare/pgadmin-5.0.7...pgadmin-5.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pgadmin-5.0.7](https://github.com/truecharts/apps/compare/pgadmin-5.0.6...pgadmin-5.0.7) (2021-12-20) diff --git a/docs/apps/stable/pgadmin/index.md b/docs/apps/stable/pgadmin/index.md index ff7586b2f45..b6c74ceed97 100644 --- a/docs/apps/stable/pgadmin/index.md +++ b/docs/apps/stable/pgadmin/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pgadmin/security.md b/docs/apps/stable/pgadmin/security.md index b260b580f67..90d67d581a2 100644 --- a/docs/apps/stable/pgadmin/security.md +++ b/docs/apps/stable/pgadmin/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pgadmin' of Deployment 'RELEASE-NAME-pgadmin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/photoprism/CHANGELOG.md b/docs/apps/stable/photoprism/CHANGELOG.md index 62a7b992b08..f01097f0d12 100644 --- a/docs/apps/stable/photoprism/CHANGELOG.md +++ b/docs/apps/stable/photoprism/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [photoprism-7.0.9](https://github.com/truecharts/apps/compare/photoprism-7.0.8...photoprism-7.0.9) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [photoprism-7.0.8](https://github.com/truecharts/apps/compare/photoprism-7.0.7...photoprism-7.0.8) (2021-12-19) diff --git a/docs/apps/stable/photoprism/index.md b/docs/apps/stable/photoprism/index.md index 19d7dd83e04..cf2d1193444 100644 --- a/docs/apps/stable/photoprism/index.md +++ b/docs/apps/stable/photoprism/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/photoprism/security.md b/docs/apps/stable/photoprism/security.md index 10f3c7bf000..f8aba7dbbc5 100644 --- a/docs/apps/stable/photoprism/security.md +++ b/docs/apps/stable/photoprism/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -36,16 +32,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoprism' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoprism' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-photoprism' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -54,7 +47,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/photoprism:v20211215@sha256:2f98a254657a06f0648f66d3bf14a9d190c5e7fa8b6d25e5970aa854a1d891f0 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -276,7 +269,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| **gobinary** @@ -319,7 +312,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/photoshow/CHANGELOG.md b/docs/apps/stable/photoshow/CHANGELOG.md index 19e5be4a598..57e373ac781 100644 --- a/docs/apps/stable/photoshow/CHANGELOG.md +++ b/docs/apps/stable/photoshow/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [photoshow-1.0.30](https://github.com/truecharts/apps/compare/photoshow-1.0.29...photoshow-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [photoshow-1.0.29](https://github.com/truecharts/apps/compare/photoshow-1.0.28...photoshow-1.0.29) (2021-12-19) diff --git a/docs/apps/stable/photoshow/index.md b/docs/apps/stable/photoshow/index.md index 58bdd464706..90ebb32ff15 100644 --- a/docs/apps/stable/photoshow/index.md +++ b/docs/apps/stable/photoshow/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/photoshow/security.md b/docs/apps/stable/photoshow/security.md index 34493901d54..600e8ad242e 100644 --- a/docs/apps/stable/photoshow/security.md +++ b/docs/apps/stable/photoshow/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-photoshow' of Deployment 'RELEASE-NAME-photoshow' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/phpldapadmin/CHANGELOG.md b/docs/apps/stable/phpldapadmin/CHANGELOG.md index 9223479c1d9..138659ce7c6 100644 --- a/docs/apps/stable/phpldapadmin/CHANGELOG.md +++ b/docs/apps/stable/phpldapadmin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [phpldapadmin-4.0.27](https://github.com/truecharts/apps/compare/phpldapadmin-4.0.26...phpldapadmin-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [phpldapadmin-4.0.26](https://github.com/truecharts/apps/compare/phpldapadmin-4.0.25...phpldapadmin-4.0.26) (2021-12-19) diff --git a/docs/apps/stable/phpldapadmin/index.md b/docs/apps/stable/phpldapadmin/index.md index c5ca76ed8ea..49d3a4ea241 100644 --- a/docs/apps/stable/phpldapadmin/index.md +++ b/docs/apps/stable/phpldapadmin/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/phpldapadmin/security.md b/docs/apps/stable/phpldapadmin/security.md index 07163b8ea84..28f96039a44 100644 --- a/docs/apps/stable/phpldapadmin/security.md +++ b/docs/apps/stable/phpldapadmin/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-phpldapadmin' of Deployment 'RELEASE-NAME-phpldapadmin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -98,6 +94,8 @@ hide: | apache2 | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2 | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2 | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2 | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2 | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2 | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2 | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2 | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -122,6 +120,8 @@ hide: | apache2-bin | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-bin | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-bin | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-bin | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-bin | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-bin | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-bin | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-bin | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -146,6 +146,8 @@ hide: | apache2-data | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-data | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-data | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-data | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-data | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-data | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-data | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-data | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| @@ -170,6 +172,8 @@ hide: | apache2-utils | CVE-2020-1927 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
http://www.openwall.com/lists/oss-security/2020/04/03/1
http://www.openwall.com/lists/oss-security/2020/04/04/1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1927
https://linux.oracle.com/cve/CVE-2020-1927.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-utils | CVE-2020-1934 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u4 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-1934
https://linux.oracle.com/cve/CVE-2020-1934.html
https://linux.oracle.com/errata/ELSA-2020-4751.html
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/
https://security.netapp.com/advisory/ntap-20200413-0002/
https://ubuntu.com/security/notices/USN-4458-1
https://usn.ubuntu.com/4458-1/
https://www.debian.org/security/2020/dsa-4757
https://www.oracle.com/security-alerts/cpujul2020.html
| | apache2-utils | CVE-2021-30641 | MEDIUM | 2.4.38-3+deb10u3 | 2.4.38-3+deb10u5 |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/06/10/8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
https://httpd.apache.org/security/vulnerabilities_24.html
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-30641
https://linux.oracle.com/cve/CVE-2021-30641.html
https://linux.oracle.com/errata/ELSA-2021-4257.html
https://lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10@%3Cannounce.httpd.apache.org%3E
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
https://security.gentoo.org/glsa/202107-38
https://security.netapp.com/advisory/ntap-20210702-0001/
https://ubuntu.com/security/notices/USN-4994-1
https://ubuntu.com/security/notices/USN-4994-2
https://www.debian.org/security/2021/dsa-4937
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| apache2-utils | CVE-2021-44224 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44224
https://httpd.apache.org/security/vulnerabilities_24.html
| +| apache2-utils | CVE-2021-44790 | MEDIUM | 2.4.38-3+deb10u3 | |
Expand...http://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2021/12/20/4
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44790
https://httpd.apache.org/security/vulnerabilities_24.html
| | apache2-utils | CVE-2001-1534 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00084.html
http://www.iss.net/security_center/static/7494.php
http://www.securityfocus.com/bid/3521
| | apache2-utils | CVE-2003-1307 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://bugs.php.net/38915
http://hackerdom.ru/~dimmo/phpexpl.c
http://www.securityfocus.com/archive/1/348368
http://www.securityfocus.com/archive/1/449234/100/0/threaded
http://www.securityfocus.com/archive/1/449298/100/0/threaded
http://www.securityfocus.com/bid/9302
| | apache2-utils | CVE-2003-1580 | LOW | 2.4.38-3+deb10u3 | |
Expand...http://www.securityfocus.com/archive/1/313867
| diff --git a/docs/apps/stable/piaware/CHANGELOG.md b/docs/apps/stable/piaware/CHANGELOG.md index d1390aea9fa..d2a26c3865e 100644 --- a/docs/apps/stable/piaware/CHANGELOG.md +++ b/docs/apps/stable/piaware/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [piaware-4.0.31](https://github.com/truecharts/apps/compare/piaware-4.0.30...piaware-4.0.31) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [piaware-4.0.30](https://github.com/truecharts/apps/compare/piaware-4.0.29...piaware-4.0.30) (2021-12-20) diff --git a/docs/apps/stable/piaware/index.md b/docs/apps/stable/piaware/index.md index e62604ae9bb..adee750bdd9 100644 --- a/docs/apps/stable/piaware/index.md +++ b/docs/apps/stable/piaware/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/piaware/security.md b/docs/apps/stable/piaware/security.md index b0605ddb170..a8f4630267c 100644 --- a/docs/apps/stable/piaware/security.md +++ b/docs/apps/stable/piaware/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piaware' of Deployment 'RELEASE-NAME-piaware' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/pidgin/CHANGELOG.md b/docs/apps/stable/pidgin/CHANGELOG.md index c205cb48e7a..a99bfbec7d0 100644 --- a/docs/apps/stable/pidgin/CHANGELOG.md +++ b/docs/apps/stable/pidgin/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pidgin-0.0.7](https://github.com/truecharts/apps/compare/pidgin-0.0.6...pidgin-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pidgin-0.0.6](https://github.com/truecharts/apps/compare/pidgin-0.0.5...pidgin-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/pidgin/index.md b/docs/apps/stable/pidgin/index.md index 21a6283929c..8e5399c12d7 100644 --- a/docs/apps/stable/pidgin/index.md +++ b/docs/apps/stable/pidgin/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pidgin/security.md b/docs/apps/stable/pidgin/security.md index 1ed3da7c581..5e335409b1a 100644 --- a/docs/apps/stable/pidgin/security.md +++ b/docs/apps/stable/pidgin/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pidgin' of Deployment 'RELEASE-NAME-pidgin' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -86,10 +83,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** @@ -118,10 +114,9 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/pihole/CHANGELOG.md b/docs/apps/stable/pihole/CHANGELOG.md index 9fd14c8b4f9..5af4873f770 100644 --- a/docs/apps/stable/pihole/CHANGELOG.md +++ b/docs/apps/stable/pihole/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pihole-4.0.29](https://github.com/truecharts/apps/compare/pihole-4.0.28...pihole-4.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pihole-4.0.28](https://github.com/truecharts/apps/compare/pihole-4.0.27...pihole-4.0.28) (2021-12-19) diff --git a/docs/apps/stable/pihole/index.md b/docs/apps/stable/pihole/index.md index c39dcdc4787..826b4373ade 100644 --- a/docs/apps/stable/pihole/index.md +++ b/docs/apps/stable/pihole/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pihole/security.md b/docs/apps/stable/pihole/security.md index 1311df7d9c5..a92b654f582 100644 --- a/docs/apps/stable/pihole/security.md +++ b/docs/apps/stable/pihole/security.md @@ -21,12 +21,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pihole' of Deployment 'RELEASE-NAME-pihole' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/piwigo/CHANGELOG.md b/docs/apps/stable/piwigo/CHANGELOG.md index 4fbe5e8aeb8..3670fa39454 100644 --- a/docs/apps/stable/piwigo/CHANGELOG.md +++ b/docs/apps/stable/piwigo/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [piwigo-1.0.27](https://github.com/truecharts/apps/compare/piwigo-1.0.26...piwigo-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [piwigo-1.0.26](https://github.com/truecharts/apps/compare/piwigo-1.0.25...piwigo-1.0.26) (2021-12-19) diff --git a/docs/apps/stable/piwigo/index.md b/docs/apps/stable/piwigo/index.md index 58e4dbe0ccd..4e99797434c 100644 --- a/docs/apps/stable/piwigo/index.md +++ b/docs/apps/stable/piwigo/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/piwigo/security.md b/docs/apps/stable/piwigo/security.md index df81d2c7458..9ca2ea2d481 100644 --- a/docs/apps/stable/piwigo/security.md +++ b/docs/apps/stable/piwigo/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-piwigo' of Deployment 'RELEASE-NAME-piwigo' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/pixapop/CHANGELOG.md b/docs/apps/stable/pixapop/CHANGELOG.md index 7eeab0f48d0..5c30f7c7c47 100644 --- a/docs/apps/stable/pixapop/CHANGELOG.md +++ b/docs/apps/stable/pixapop/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pixapop-1.0.26](https://github.com/truecharts/apps/compare/pixapop-1.0.25...pixapop-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pixapop-1.0.25](https://github.com/truecharts/apps/compare/pixapop-1.0.24...pixapop-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/pixapop/index.md b/docs/apps/stable/pixapop/index.md index e0ffbaf8e1c..3f751234c5c 100644 --- a/docs/apps/stable/pixapop/index.md +++ b/docs/apps/stable/pixapop/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pixapop/security.md b/docs/apps/stable/pixapop/security.md index 89f1d7824e9..223a32d0807 100644 --- a/docs/apps/stable/pixapop/security.md +++ b/docs/apps/stable/pixapop/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pixapop' of Deployment 'RELEASE-NAME-pixapop' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -142,12 +138,12 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| symfony/cache | CVE-2019-18889 | CRITICAL | v4.2.3 | 4.1.0, 4.2.0, 4.2.12, 4.3.8, 3.2.0, 3.3.0, 3.4.0, 3.4.35 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18889
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml
https://github.com/advisories/GHSA-79gr-58r3-pwm3
https://github.com/symfony/symfony/commit/8817d28fcaacb31fe01d267f6e19b44d8179395a
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://nvd.nist.gov/vuln/detail/CVE-2019-18889
https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18889
| -| symfony/cache | CVE-2019-10912 | HIGH | v4.2.3 | 4.2.7, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 4.1.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
https://github.com/advisories/GHSA-w2fr-65vp-mxw3
https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
https://nvd.nist.gov/vuln/detail/CVE-2019-10912
https://seclists.org/bugtraq/2019/May/21
https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
https://symfony.com/cve-2019-10912
https://typo3.org/security/advisory/typo3-core-sa-2019-016
https://typo3.org/security/advisory/typo3-core-sa-2019-016/
https://www.debian.org/security/2019/dsa-4441
| -| symfony/dependency-injection | CVE-2019-10910 | CRITICAL | v4.2.4 | 3.1.0, 3.2.0, 3.4.0, 4.1.0, 4.1.12, 2.7.51, 3.3.0, 3.4.26, 4.2.7, 2.8.50 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
https://github.com/advisories/GHSA-pgwj-prpq-jpc2
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://nvd.nist.gov/vuln/detail/CVE-2019-10910
https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
https://symfony.com/cve-2019-10910
https://www.drupal.org/SA-CORE-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| -| symfony/framework-bundle | CVE-2019-10909 | MEDIUM | v4.2.3 | 4.1.0, 4.2.7, 3.2.0, 3.4.0, 3.4.26, 3.3.0, 4.1.12, 2.7.51, 2.8.50, 3.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
https://github.com/advisories/GHSA-g996-q5r8-w7g2
https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
https://nvd.nist.gov/vuln/detail/CVE-2019-10909
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
https://symfony.com/cve-2019-10909
https://www.drupal.org/SA-CORE-2019-005
https://www.drupal.org/sa-core-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| -| symfony/http-foundation | CVE-2019-10913 | CRITICAL | v4.2.4 | 3.1.0, 3.2.0, 4.1.12, 4.2.7, 2.7.51, 3.3.0, 3.4.0, 3.4.26, 4.1.0, 2.8.50 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
https://github.com/advisories/GHSA-x92h-wmg2-6hp7
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
https://nvd.nist.gov/vuln/detail/CVE-2019-10913
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
https://symfony.com/cve-2019-10913
| -| symfony/http-foundation | CVE-2019-18888 | HIGH | v4.2.4 | 2.4.0, 2.6.0, 3.2.0, 3.3.0, 4.3.8, 2.3.0, 3.1.0, 3.4.35, 4.2.0, 2.7.0, 2.2.0, 2.5.0, 2.8.52, 3.4.0, 2.1.0, 4.1.0, 4.2.12, 2.8.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18888
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
https://github.com/advisories/GHSA-xhh6-956q-4q69
https://github.com/symfony/symfony/commit/691486e43ce0e4893cd703e221bafc10a871f365
https://github.com/symfony/symfony/commit/77ddabf2e785ea85860d2720cc86f7c5d8967ed5
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://nvd.nist.gov/vuln/detail/CVE-2019-18888
https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18888
| -| symfony/http-kernel | CVE-2019-18887 | HIGH | v4.2.4 | 2.8.0, 3.3.0, 2.3.0, 2.6.0, 4.1.0, 4.2.12, 4.3.8, 2.4.0, 2.5.0, 2.7.0, 2.8.52, 3.1.0, 3.2.0, 3.4.0, 3.4.35, 4.2.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18887
https://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18887
| +| symfony/cache | CVE-2019-18889 | CRITICAL | v4.2.3 | 4.2.0, 4.2.12, 4.3.8, 3.2.0, 3.3.0, 3.4.0, 3.4.35, 4.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18889
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml
https://github.com/advisories/GHSA-79gr-58r3-pwm3
https://github.com/symfony/symfony/commit/8817d28fcaacb31fe01d267f6e19b44d8179395a
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://nvd.nist.gov/vuln/detail/CVE-2019-18889
https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18889
| +| symfony/cache | CVE-2019-10912 | HIGH | v4.2.3 | 4.1.0, 4.1.12, 4.2.7, 3.2.0, 3.3.0, 3.4.0, 3.4.26 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
https://github.com/advisories/GHSA-w2fr-65vp-mxw3
https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
https://nvd.nist.gov/vuln/detail/CVE-2019-10912
https://seclists.org/bugtraq/2019/May/21
https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
https://symfony.com/cve-2019-10912
https://typo3.org/security/advisory/typo3-core-sa-2019-016
https://typo3.org/security/advisory/typo3-core-sa-2019-016/
https://www.debian.org/security/2019/dsa-4441
| +| symfony/dependency-injection | CVE-2019-10910 | CRITICAL | v4.2.4 | 2.8.50, 4.1.0, 4.2.7, 2.7.51, 3.2.0, 3.3.0, 3.4.0, 3.4.26, 4.1.12, 3.1.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml
https://github.com/advisories/GHSA-pgwj-prpq-jpc2
https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b
https://nvd.nist.gov/vuln/detail/CVE-2019-10910
https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
https://symfony.com/cve-2019-10910
https://www.drupal.org/SA-CORE-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| +| symfony/framework-bundle | CVE-2019-10909 | MEDIUM | v4.2.3 | 3.4.26, 4.1.0, 4.2.7, 2.7.51, 3.1.0, 3.3.0, 4.1.12, 2.8.50, 3.2.0, 3.4.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml
https://github.com/advisories/GHSA-g996-q5r8-w7g2
https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2
https://nvd.nist.gov/vuln/detail/CVE-2019-10909
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
https://symfony.com/cve-2019-10909
https://www.drupal.org/SA-CORE-2019-005
https://www.drupal.org/sa-core-2019-005
https://www.synology.com/security/advisory/Synology_SA_19_19
| +| symfony/http-foundation | CVE-2019-10913 | CRITICAL | v4.2.4 | 3.1.0, 3.3.0, 3.4.26, 4.1.0, 4.2.7, 2.7.51, 2.8.50, 3.2.0, 3.4.0, 4.1.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
https://github.com/advisories/GHSA-x92h-wmg2-6hp7
https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
https://nvd.nist.gov/vuln/detail/CVE-2019-10913
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
https://symfony.com/cve-2019-10913
| +| symfony/http-foundation | CVE-2019-18888 | HIGH | v4.2.4 | 2.5.0, 3.1.0, 4.2.0, 2.3.0, 2.4.0, 3.3.0, 2.8.0, 2.8.52, 3.2.0, 3.4.35, 4.1.0, 2.1.0, 2.2.0, 2.7.0, 4.3.8, 2.6.0, 3.4.0, 4.2.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18888
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
https://github.com/advisories/GHSA-xhh6-956q-4q69
https://github.com/symfony/symfony/commit/691486e43ce0e4893cd703e221bafc10a871f365
https://github.com/symfony/symfony/commit/77ddabf2e785ea85860d2720cc86f7c5d8967ed5
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://nvd.nist.gov/vuln/detail/CVE-2019-18888
https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18888
| +| symfony/http-kernel | CVE-2019-18887 | HIGH | v4.2.4 | 4.2.0, 2.4.0, 2.7.0, 2.8.52, 4.1.0, 2.8.0, 3.3.0, 3.4.35, 4.3.8, 2.6.0, 3.1.0, 3.2.0, 3.4.0, 2.3.0, 2.5.0, 4.2.12 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18887
https://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-18887
| | symfony/var-exporter | CVE-2019-11325 | CRITICAL | v4.2.3 | 4.2.12, 4.3.8 |
Expand...https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-11325.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/var-exporter/CVE-2019-11325.yaml
https://github.com/advisories/GHSA-w4rc-rx25-8m86
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
https://nvd.nist.gov/vuln/detail/CVE-2019-11325
https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
https://symfony.com/blog/symfony-4-3-8-released
https://symfony.com/cve-2019-11325
| | twig/twig | CVE-2019-9942 | LOW | v2.6.2 | 1.38.0, 2.7.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9942
https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077
https://seclists.org/bugtraq/2019/Mar/60
https://symfony.com/blog/twig-sandbox-information-disclosure
https://www.debian.org/security/2019/dsa-4419
| diff --git a/docs/apps/stable/plex/CHANGELOG.md b/docs/apps/stable/plex/CHANGELOG.md index 8ad81f24b43..969f5ef73eb 100644 --- a/docs/apps/stable/plex/CHANGELOG.md +++ b/docs/apps/stable/plex/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [plex-8.0.27](https://github.com/truecharts/apps/compare/plex-8.0.26...plex-8.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [plex-8.0.26](https://github.com/truecharts/apps/compare/plex-8.0.25...plex-8.0.26) (2021-12-19) diff --git a/docs/apps/stable/plex/index.md b/docs/apps/stable/plex/index.md index 09f14ec6979..5515fe3afd7 100644 --- a/docs/apps/stable/plex/index.md +++ b/docs/apps/stable/plex/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/plex/security.md b/docs/apps/stable/plex/security.md index 3ec75a11159..e9a7247a850 100644 --- a/docs/apps/stable/plex/security.md +++ b/docs/apps/stable/plex/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-plex' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-plex' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-plex' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -164,4 +161,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/podgrab/CHANGELOG.md b/docs/apps/stable/podgrab/CHANGELOG.md index 77ee0f9913a..5ce0bf861ff 100644 --- a/docs/apps/stable/podgrab/CHANGELOG.md +++ b/docs/apps/stable/podgrab/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [podgrab-8.0.7](https://github.com/truecharts/apps/compare/podgrab-8.0.6...podgrab-8.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [podgrab-8.0.6](https://github.com/truecharts/apps/compare/podgrab-8.0.5...podgrab-8.0.6) (2021-12-19) diff --git a/docs/apps/stable/podgrab/index.md b/docs/apps/stable/podgrab/index.md index 12a0e392ec9..bbfa09ce298 100644 --- a/docs/apps/stable/podgrab/index.md +++ b/docs/apps/stable/podgrab/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/podgrab/security.md b/docs/apps/stable/podgrab/security.md index 9d14f04bb69..66a95d64d38 100644 --- a/docs/apps/stable/podgrab/security.md +++ b/docs/apps/stable/podgrab/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-podgrab' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-podgrab' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-podgrab' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -87,5 +84,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | v1.2.1-0.20181016170032-d91630c85102 |
Expand...
| +| github.com/satori/go.uuid | GO-2020-0018 | UNKNOWN | v1.2.0 | 1.2.1-0.20181016170032-d91630c85102 |
Expand...
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200820211705-5c72a883971a | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/pretend-youre-xyzzy/CHANGELOG.md b/docs/apps/stable/pretend-youre-xyzzy/CHANGELOG.md index 1e2672ed8d1..08bb4354018 100644 --- a/docs/apps/stable/pretend-youre-xyzzy/CHANGELOG.md +++ b/docs/apps/stable/pretend-youre-xyzzy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pretend-youre-xyzzy-4.0.26](https://github.com/truecharts/apps/compare/pretend-youre-xyzzy-4.0.25...pretend-youre-xyzzy-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pretend-youre-xyzzy-4.0.25](https://github.com/truecharts/apps/compare/pretend-youre-xyzzy-4.0.24...pretend-youre-xyzzy-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/pretend-youre-xyzzy/index.md b/docs/apps/stable/pretend-youre-xyzzy/index.md index 1e01a72148f..39ea12e13d0 100644 --- a/docs/apps/stable/pretend-youre-xyzzy/index.md +++ b/docs/apps/stable/pretend-youre-xyzzy/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pretend-youre-xyzzy/security.md b/docs/apps/stable/pretend-youre-xyzzy/security.md index fc81fd3d929..267447de4fc 100644 --- a/docs/apps/stable/pretend-youre-xyzzy/security.md +++ b/docs/apps/stable/pretend-youre-xyzzy/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pretend-youre-xyzzy' of Deployment 'RELEASE-NAME-pretend-youre-xyzzy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/projectsend/CHANGELOG.md b/docs/apps/stable/projectsend/CHANGELOG.md index eb186868037..b4abd4962d0 100644 --- a/docs/apps/stable/projectsend/CHANGELOG.md +++ b/docs/apps/stable/projectsend/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [projectsend-0.0.7](https://github.com/truecharts/apps/compare/projectsend-0.0.6...projectsend-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [projectsend-0.0.6](https://github.com/truecharts/apps/compare/projectsend-0.0.5...projectsend-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/projectsend/index.md b/docs/apps/stable/projectsend/index.md index c1981b13737..de3981a9933 100644 --- a/docs/apps/stable/projectsend/index.md +++ b/docs/apps/stable/projectsend/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/projectsend/security.md b/docs/apps/stable/projectsend/security.md index 3bec8243c9a..ae3f013f821 100644 --- a/docs/apps/stable/projectsend/security.md +++ b/docs/apps/stable/projectsend/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-projectsend' of Deployment 'RELEASE-NAME-projectsend' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/promcord/CHANGELOG.md b/docs/apps/stable/promcord/CHANGELOG.md index db3cf8025d2..2d74a2406de 100644 --- a/docs/apps/stable/promcord/CHANGELOG.md +++ b/docs/apps/stable/promcord/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [promcord-2.0.7](https://github.com/truecharts/apps/compare/promcord-2.0.6...promcord-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [promcord-2.0.6](https://github.com/truecharts/apps/compare/promcord-2.0.5...promcord-2.0.6) (2021-12-19) diff --git a/docs/apps/stable/promcord/index.md b/docs/apps/stable/promcord/index.md index 745c498d287..535d7cb428d 100644 --- a/docs/apps/stable/promcord/index.md +++ b/docs/apps/stable/promcord/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/promcord/security.md b/docs/apps/stable/promcord/security.md index 40a882cb7a6..09fe380ea6b 100644 --- a/docs/apps/stable/promcord/security.md +++ b/docs/apps/stable/promcord/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-promcord' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-promcord' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-promcord' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/protonmail-bridge/CHANGELOG.md b/docs/apps/stable/protonmail-bridge/CHANGELOG.md index 51f329f1dea..2dc59994245 100644 --- a/docs/apps/stable/protonmail-bridge/CHANGELOG.md +++ b/docs/apps/stable/protonmail-bridge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [protonmail-bridge-4.0.26](https://github.com/truecharts/apps/compare/protonmail-bridge-4.0.25...protonmail-bridge-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [protonmail-bridge-4.0.25](https://github.com/truecharts/apps/compare/protonmail-bridge-4.0.24...protonmail-bridge-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/protonmail-bridge/index.md b/docs/apps/stable/protonmail-bridge/index.md index 12c5835dc99..014933e2229 100644 --- a/docs/apps/stable/protonmail-bridge/index.md +++ b/docs/apps/stable/protonmail-bridge/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/protonmail-bridge/security.md b/docs/apps/stable/protonmail-bridge/security.md index dccbae73173..b9e87705324 100644 --- a/docs/apps/stable/protonmail-bridge/security.md +++ b/docs/apps/stable/protonmail-bridge/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-protonmail-bridge' of Deployment 'RELEASE-NAME-protonmail-bridge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -179,13 +175,13 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| - - +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5-0.20201125200606-c27b9fd57aec | 0.3.7 |
Expand...
| **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.5-0.20201125200606-c27b9fd57aec | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/prowlarr/CHANGELOG.md b/docs/apps/stable/prowlarr/CHANGELOG.md index 11741bfbcfe..52fbe75df3c 100644 --- a/docs/apps/stable/prowlarr/CHANGELOG.md +++ b/docs/apps/stable/prowlarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [prowlarr-4.0.45](https://github.com/truecharts/apps/compare/prowlarr-4.0.44...prowlarr-4.0.45) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [prowlarr-4.0.44](https://github.com/truecharts/apps/compare/prowlarr-4.0.43...prowlarr-4.0.44) (2021-12-19) diff --git a/docs/apps/stable/prowlarr/helm-values.md b/docs/apps/stable/prowlarr/helm-values.md index 1b9ae0838f9..10ebfc40877 100644 --- a/docs/apps/stable/prowlarr/helm-values.md +++ b/docs/apps/stable/prowlarr/helm-values.md @@ -15,7 +15,7 @@ You will, however, be able to use all values referenced in the common chart here | env.TZ | string | `"UTC"` | Set the container timezone | | image.pullPolicy | string | `"IfNotPresent"` | image pull policy | | image.repository | string | `"tccr.io/truecharts/prowlarr"` | image repository | -| image.tag | string | `"v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b"` | image tag | +| image.tag | string | `"v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb"` | image tag | | ingress.main | object | See values.yaml | Enable and configure ingress settings for the chart under this key. | | persistence | object | See values.yaml | Configure persistence settings for the chart under this key. | | securityContext.readOnlyRootFilesystem | bool | `false` | | diff --git a/docs/apps/stable/prowlarr/index.md b/docs/apps/stable/prowlarr/index.md index d6a28daa230..bbeae5d4e31 100644 --- a/docs/apps/stable/prowlarr/index.md +++ b/docs/apps/stable/prowlarr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/prowlarr/security.md b/docs/apps/stable/prowlarr/security.md index 80111db466c..4761e699d32 100644 --- a/docs/apps/stable/prowlarr/security.md +++ b/docs/apps/stable/prowlarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-prowlarr' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-prowlarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-prowlarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b + tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:119d2d84e57ee28891b9269fbc482bd5e54d022b523496efe51a2563a328226b (ubuntu 20.04) +#### Container: tccr.io/truecharts/prowlarr:v0.1.8.1265@sha256:ed72a7bd1b9d36edb7d73fb68f9edee73d31d38e83d5a1ac0343443110a34dfb (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -125,12 +118,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -150,16 +141,16 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/pwndrop/CHANGELOG.md b/docs/apps/stable/pwndrop/CHANGELOG.md index fc3dbdbac92..70a2f8a7e3e 100644 --- a/docs/apps/stable/pwndrop/CHANGELOG.md +++ b/docs/apps/stable/pwndrop/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pwndrop-0.0.7](https://github.com/truecharts/apps/compare/pwndrop-0.0.6...pwndrop-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pwndrop-0.0.6](https://github.com/truecharts/apps/compare/pwndrop-0.0.5...pwndrop-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/pwndrop/index.md b/docs/apps/stable/pwndrop/index.md index 1e16892cd31..f79dc50daed 100644 --- a/docs/apps/stable/pwndrop/index.md +++ b/docs/apps/stable/pwndrop/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pwndrop/security.md b/docs/apps/stable/pwndrop/security.md index 7c2e2258601..526b9144a2e 100644 --- a/docs/apps/stable/pwndrop/security.md +++ b/docs/apps/stable/pwndrop/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pwndrop' of Deployment 'RELEASE-NAME-pwndrop' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -81,6 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/miekg/dns | CVE-2019-19794 | MEDIUM | v1.1.12 | v1.1.25-0.20191211073109-8ebf2e419df7 |
Expand...https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
| +| github.com/miekg/dns | CVE-2019-19794 | MEDIUM | v1.1.12 | 1.1.25-0.20191211073109-8ebf2e419df7 |
Expand...https://github.com/coredns/coredns/issues/3519
https://github.com/coredns/coredns/issues/3547
https://github.com/miekg/dns/compare/v1.1.24...v1.1.25
https://github.com/miekg/dns/issues/1043
https://github.com/miekg/dns/pull/1044
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200117160349-530e935923ad | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20200117160349-530e935923ad | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/pydio-cells/CHANGELOG.md b/docs/apps/stable/pydio-cells/CHANGELOG.md index 36b3b8e7e68..cbd96e13638 100644 --- a/docs/apps/stable/pydio-cells/CHANGELOG.md +++ b/docs/apps/stable/pydio-cells/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pydio-cells-0.0.8](https://github.com/truecharts/apps/compare/pydio-cells-0.0.7...pydio-cells-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pydio-cells-0.0.7](https://github.com/truecharts/apps/compare/pydio-cells-0.0.6...pydio-cells-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/pydio-cells/index.md b/docs/apps/stable/pydio-cells/index.md index d20caad553d..572307715a2 100644 --- a/docs/apps/stable/pydio-cells/index.md +++ b/docs/apps/stable/pydio-cells/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pydio-cells/security.md b/docs/apps/stable/pydio-cells/security.md index a455c8cd28c..c0f10e3098d 100644 --- a/docs/apps/stable/pydio-cells/security.md +++ b/docs/apps/stable/pydio-cells/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pydio-cells' of Deployment 'RELEASE-NAME-pydio-cells' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/pyload/CHANGELOG.md b/docs/apps/stable/pyload/CHANGELOG.md index 8c473ec7fa6..01ba7ee929e 100644 --- a/docs/apps/stable/pyload/CHANGELOG.md +++ b/docs/apps/stable/pyload/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pyload-4.0.26](https://github.com/truecharts/apps/compare/pyload-4.0.25...pyload-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pyload-4.0.25](https://github.com/truecharts/apps/compare/pyload-4.0.24...pyload-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/pyload/index.md b/docs/apps/stable/pyload/index.md index eec78273583..f081a6a74ce 100644 --- a/docs/apps/stable/pyload/index.md +++ b/docs/apps/stable/pyload/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pyload/security.md b/docs/apps/stable/pyload/security.md index 7605a2c8fe0..a0d6acbaf06 100644 --- a/docs/apps/stable/pyload/security.md +++ b/docs/apps/stable/pyload/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pyload' of Deployment 'RELEASE-NAME-pyload' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/pylon/CHANGELOG.md b/docs/apps/stable/pylon/CHANGELOG.md index 9c66c0cd067..83df58e38fa 100644 --- a/docs/apps/stable/pylon/CHANGELOG.md +++ b/docs/apps/stable/pylon/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [pylon-0.0.7](https://github.com/truecharts/apps/compare/pylon-0.0.6...pylon-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [pylon-0.0.6](https://github.com/truecharts/apps/compare/pylon-0.0.5...pylon-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/pylon/index.md b/docs/apps/stable/pylon/index.md index 86c80508d71..c91d6ba6f34 100644 --- a/docs/apps/stable/pylon/index.md +++ b/docs/apps/stable/pylon/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/pylon/security.md b/docs/apps/stable/pylon/security.md index f423e6e97fe..62319dc9379 100644 --- a/docs/apps/stable/pylon/security.md +++ b/docs/apps/stable/pylon/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-pylon' of Deployment 'RELEASE-NAME-pylon' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/qbittorrent/CHANGELOG.md b/docs/apps/stable/qbittorrent/CHANGELOG.md index d91ec59d6c1..74dfacf502e 100644 --- a/docs/apps/stable/qbittorrent/CHANGELOG.md +++ b/docs/apps/stable/qbittorrent/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [qbittorrent-9.0.29](https://github.com/truecharts/apps/compare/qbittorrent-9.0.28...qbittorrent-9.0.29) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [qbittorrent-9.0.28](https://github.com/truecharts/apps/compare/qbittorrent-9.0.27...qbittorrent-9.0.28) (2021-12-19) diff --git a/docs/apps/stable/qbittorrent/helm-values.md b/docs/apps/stable/qbittorrent/helm-values.md index 11806a8a4ec..1cd39861aeb 100644 --- a/docs/apps/stable/qbittorrent/helm-values.md +++ b/docs/apps/stable/qbittorrent/helm-values.md @@ -18,7 +18,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/qbittorrent"` | | -| image.tag | string | `"v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c"` | | +| image.tag | string | `"v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | securityContext.readOnlyRootFilesystem | bool | `false` | | diff --git a/docs/apps/stable/qbittorrent/index.md b/docs/apps/stable/qbittorrent/index.md index f30a5de0b4d..a5a2b0f1f50 100644 --- a/docs/apps/stable/qbittorrent/index.md +++ b/docs/apps/stable/qbittorrent/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/qbittorrent/security.md b/docs/apps/stable/qbittorrent/security.md index 72f6785ddef..696f4ca0685 100644 --- a/docs/apps/stable/qbittorrent/security.md +++ b/docs/apps/stable/qbittorrent/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-qbittorrent' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-qbittorrent' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-qbittorrent' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/qbittorrent:v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c + tccr.io/truecharts/qbittorrent:v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/qbittorrent:v4.3.9@sha256:6508ca6bd05d003d92852d5bd8deaae3176d776a5789ad68199ba1807d43cf8c (ubuntu 20.04) +#### Container: tccr.io/truecharts/qbittorrent:v4.3.9@sha256:b4f43746875fe33ac9614e4eadd4f4becd6b5591c68b731205c937bbd9047fcf (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -116,7 +109,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -128,12 +120,10 @@ hide: | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libperl5.30 | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libqt5core5a | CVE-2020-13962 | MEDIUM | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html
https://bugreports.qt.io/browse/QTBUG-83450
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13962
https://github.com/mumble-voip/mumble/issues/3679
https://github.com/mumble-voip/mumble/pull/4032
https://linux.oracle.com/cve/CVE-2020-13962.html
https://linux.oracle.com/errata/ELSA-2020-4690.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
https://security.gentoo.org/glsa/202007-18
| | libqt5core5a | CVE-2020-17507 | LOW | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00071.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00073.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00090.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00104.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00105.html
https://codereview.qt-project.org/c/qt/qtbase/+/308436
https://codereview.qt-project.org/c/qt/qtbase/+/308495
https://codereview.qt-project.org/c/qt/qtbase/+/308496
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17507
https://linux.oracle.com/cve/CVE-2020-17507.html
https://linux.oracle.com/errata/ELSA-2021-1756.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00023.html
https://lists.debian.org/debian-lts-announce/2020/09/msg00024.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/426FCC6JNK4JUEX5QHJQDYQ6MUVQ3E6P/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBPZVZNEYXGATTXM4WOE7OQ55VAKPVD6/
https://security.gentoo.org/glsa/202009-04
https://ubuntu.com/security/notices/USN-5081-1
| | libqt5dbus5 | CVE-2020-13962 | MEDIUM | 5.12.8+dfsg-0ubuntu1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00004.html
https://bugreports.qt.io/browse/QTBUG-83450
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13962
https://github.com/mumble-voip/mumble/issues/3679
https://github.com/mumble-voip/mumble/pull/4032
https://linux.oracle.com/cve/CVE-2020-13962.html
https://linux.oracle.com/errata/ELSA-2020-4690.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X6EDPIIAQPVP2CHL2CHDHJ25EECA7UE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQJDBZUYMMF4R5QQKD2HTIKQU2NSKO63/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3IZY7LKJ6NAXQDFYFR4S7L5BBHYK53K/
https://security.gentoo.org/glsa/202007-18
| @@ -163,12 +153,10 @@ hide: | perl | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| | perl-modules-5.30 | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| **gobinary** @@ -176,4 +164,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/quassel-core/CHANGELOG.md b/docs/apps/stable/quassel-core/CHANGELOG.md index 5820357ccae..7b247aa11bf 100644 --- a/docs/apps/stable/quassel-core/CHANGELOG.md +++ b/docs/apps/stable/quassel-core/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [quassel-core-0.0.8](https://github.com/truecharts/apps/compare/quassel-core-0.0.7...quassel-core-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [quassel-core-0.0.7](https://github.com/truecharts/apps/compare/quassel-core-0.0.6...quassel-core-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/quassel-core/index.md b/docs/apps/stable/quassel-core/index.md index cfe945e17aa..93ff94b2a6b 100644 --- a/docs/apps/stable/quassel-core/index.md +++ b/docs/apps/stable/quassel-core/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/quassel-core/security.md b/docs/apps/stable/quassel-core/security.md index dc87e3a66eb..2f0d606f7bc 100644 --- a/docs/apps/stable/quassel-core/security.md +++ b/docs/apps/stable/quassel-core/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,14 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-core' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-quassel-core' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -60,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/quassel-core:v0.13.1 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -100,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -354,7 +345,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/quassel-web/CHANGELOG.md b/docs/apps/stable/quassel-web/CHANGELOG.md index 2d9aaee04c7..3671e653d49 100644 --- a/docs/apps/stable/quassel-web/CHANGELOG.md +++ b/docs/apps/stable/quassel-web/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [quassel-web-0.0.7](https://github.com/truecharts/apps/compare/quassel-web-0.0.6...quassel-web-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [quassel-web-0.0.6](https://github.com/truecharts/apps/compare/quassel-web-0.0.5...quassel-web-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/quassel-web/index.md b/docs/apps/stable/quassel-web/index.md index da77fd68ebf..0b5e1005c19 100644 --- a/docs/apps/stable/quassel-web/index.md +++ b/docs/apps/stable/quassel-web/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/quassel-web/security.md b/docs/apps/stable/quassel-web/security.md index 320ff5c23b9..2eb39353ca3 100644 --- a/docs/apps/stable/quassel-web/security.md +++ b/docs/apps/stable/quassel-web/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-quassel-web' of Deployment 'RELEASE-NAME-quassel-web' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/radarr/CHANGELOG.md b/docs/apps/stable/radarr/CHANGELOG.md index f3a3343eb3a..685334c3b12 100644 --- a/docs/apps/stable/radarr/CHANGELOG.md +++ b/docs/apps/stable/radarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [radarr-9.0.27](https://github.com/truecharts/apps/compare/radarr-9.0.26...radarr-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [radarr-9.0.26](https://github.com/truecharts/apps/compare/radarr-9.0.25...radarr-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/radarr/helm-values.md b/docs/apps/stable/radarr/helm-values.md index 9f9d6c4394d..cc8fe713f7b 100644 --- a/docs/apps/stable/radarr/helm-values.md +++ b/docs/apps/stable/radarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/radarr"` | | -| image.tag | string | `"v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658"` | | +| image.tag | string | `"v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/docs/apps/stable/radarr/index.md b/docs/apps/stable/radarr/index.md index 2944e7e6fc8..609b0bcbe87 100644 --- a/docs/apps/stable/radarr/index.md +++ b/docs/apps/stable/radarr/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/radarr/security.md b/docs/apps/stable/radarr/security.md index 4e3fb97f8f6..b340ac253ae 100644 --- a/docs/apps/stable/radarr/security.md +++ b/docs/apps/stable/radarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-radarr' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-radarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-radarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/radarr:v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658 + tccr.io/truecharts/radarr:v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/radarr:v3.2.2.5080@sha256:9cfb27ef200c246b2534f8199e233e7e49b12a551ce3ba91f9ff89cfa182a658 (ubuntu 20.04) +#### Container: tccr.io/truecharts/radarr:v3.2.2.5080@sha256:bb3107b2b13df0abdf8fa2d31eb9af791cda06124e50c09ebd4684824cbf397f (ubuntu 20.04) **ubuntu** @@ -81,11 +78,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -125,12 +118,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -150,16 +141,16 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-29921 | MEDIUM | 3.8.10-0ubuntu1~20.04 | 3.8.10-0ubuntu1~20.04.1 |
Expand...https://bugs.python.org/issue36384
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921
https://docs.python.org/3/library/ipaddress.html
https://github.com/python/cpython/blob/63298930fb531ba2bb4f23bc3b915dbf1e17e9e1/Misc/NEWS.d/3.8.0a4.rst
https://github.com/python/cpython/pull/12577
https://github.com/python/cpython/pull/25099
https://github.com/sickcodes
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-014.md
https://linux.oracle.com/cve/CVE-2021-29921.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://python-security.readthedocs.io/vuln/ipaddress-ipv4-leading-zeros.html
https://security.netapp.com/advisory/ntap-20210622-0003/
https://sick.codes/sick-2021-014
https://ubuntu.com/security/notices/USN-4973-1
https://ubuntu.com/security/notices/USN-4973-2
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/readarr/CHANGELOG.md b/docs/apps/stable/readarr/CHANGELOG.md index 0cfbc03b0d3..197e4bac364 100644 --- a/docs/apps/stable/readarr/CHANGELOG.md +++ b/docs/apps/stable/readarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [readarr-9.0.41](https://github.com/truecharts/apps/compare/readarr-9.0.40...readarr-9.0.41) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [readarr-9.0.40](https://github.com/truecharts/apps/compare/readarr-9.0.39...readarr-9.0.40) (2021-12-20) diff --git a/docs/apps/stable/readarr/helm-values.md b/docs/apps/stable/readarr/helm-values.md index 0a8b1c1ffc4..fbaec45b721 100644 --- a/docs/apps/stable/readarr/helm-values.md +++ b/docs/apps/stable/readarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/readarr"` | | -| image.tag | string | `"v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f"` | | +| image.tag | string | `"v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/docs/apps/stable/readarr/index.md b/docs/apps/stable/readarr/index.md index cc2563431a9..9bd49ca8776 100644 --- a/docs/apps/stable/readarr/index.md +++ b/docs/apps/stable/readarr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/readarr/security.md b/docs/apps/stable/readarr/security.md index d7498966ab4..1b9d3fa1d76 100644 --- a/docs/apps/stable/readarr/security.md +++ b/docs/apps/stable/readarr/security.md @@ -19,23 +19,20 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-readarr' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-readarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-readarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/readarr:v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f + tccr.io/truecharts/readarr:v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008 ##### Scan Results @@ -72,7 +69,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/readarr:v0.1.0.1142@sha256:07af91b94315501183f3d55bb9e92ef33d0fa6da6aa76abe38df4f7b264c201f (ubuntu 20.04) +#### Container: tccr.io/truecharts/readarr:v0.1.0.1142@sha256:71767999c421751d711f5e4f4fdf9be8918251733f74301b7ae605239b3c7008 (ubuntu 20.04) **ubuntu** @@ -154,4 +151,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/recipes/CHANGELOG.md b/docs/apps/stable/recipes/CHANGELOG.md index ef5382fe446..d1925c23c9c 100644 --- a/docs/apps/stable/recipes/CHANGELOG.md +++ b/docs/apps/stable/recipes/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [recipes-5.0.4](https://github.com/truecharts/apps/compare/recipes-5.0.3...recipes-5.0.4) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [recipes-5.0.3](https://github.com/truecharts/apps/compare/recipes-5.0.2...recipes-5.0.3) (2021-12-20) diff --git a/docs/apps/stable/recipes/index.md b/docs/apps/stable/recipes/index.md index 933342338a2..c10ed06d508 100644 --- a/docs/apps/stable/recipes/index.md +++ b/docs/apps/stable/recipes/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/recipes/security.md b/docs/apps/stable/recipes/security.md index 4181c0b8548..570a1353d61 100644 --- a/docs/apps/stable/recipes/security.md +++ b/docs/apps/stable/recipes/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -43,10 +39,6 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| @@ -54,10 +46,6 @@ hide: | Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| | Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| | Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-recipes' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-recipes' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'nginx' of Deployment 'RELEASE-NAME-recipes' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -73,11 +61,11 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/recipes:v1.0.3@sha256:293f8d08b8326899e9ce0f4c4c8ffac521c22f168290ddfa0db1da0b81bda296 - 'tccr.io/truecharts/nginx:v1.21.4@sha256:81b9486bd8b0f8c9d933013a4b4a6267463625e0dcc756c01ec766ba386f6c93' tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -114,7 +102,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -423,7 +411,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/reg/CHANGELOG.md b/docs/apps/stable/reg/CHANGELOG.md index b70b3956b67..92d0b87ddcd 100644 --- a/docs/apps/stable/reg/CHANGELOG.md +++ b/docs/apps/stable/reg/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [reg-4.0.25](https://github.com/truecharts/apps/compare/reg-4.0.24...reg-4.0.25) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [reg-4.0.24](https://github.com/truecharts/apps/compare/reg-4.0.23...reg-4.0.24) (2021-12-19) diff --git a/docs/apps/stable/reg/index.md b/docs/apps/stable/reg/index.md index 64925fdc161..564db01e565 100644 --- a/docs/apps/stable/reg/index.md +++ b/docs/apps/stable/reg/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/reg/security.md b/docs/apps/stable/reg/security.md index f1e8de75147..7362e2f44d7 100644 --- a/docs/apps/stable/reg/security.md +++ b/docs/apps/stable/reg/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-reg' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-reg' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-reg' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/remmina/CHANGELOG.md b/docs/apps/stable/remmina/CHANGELOG.md index c28703b4473..d53cc31d128 100644 --- a/docs/apps/stable/remmina/CHANGELOG.md +++ b/docs/apps/stable/remmina/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [remmina-1.0.30](https://github.com/truecharts/apps/compare/remmina-1.0.29...remmina-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [remmina-1.0.29](https://github.com/truecharts/apps/compare/remmina-1.0.28...remmina-1.0.29) (2021-12-19) diff --git a/docs/apps/stable/remmina/index.md b/docs/apps/stable/remmina/index.md index 108934ee1e4..d39a00d2d04 100644 --- a/docs/apps/stable/remmina/index.md +++ b/docs/apps/stable/remmina/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/remmina/security.md b/docs/apps/stable/remmina/security.md index 825588a1515..711553f2022 100644 --- a/docs/apps/stable/remmina/security.md +++ b/docs/apps/stable/remmina/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-remmina' of Deployment 'RELEASE-NAME-remmina' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -331,3 +327,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/requestrr/CHANGELOG.md b/docs/apps/stable/requestrr/CHANGELOG.md index 9867119ddf5..825400d3162 100644 --- a/docs/apps/stable/requestrr/CHANGELOG.md +++ b/docs/apps/stable/requestrr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [requestrr-0.0.7](https://github.com/truecharts/apps/compare/requestrr-0.0.6...requestrr-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [requestrr-0.0.6](https://github.com/truecharts/apps/compare/requestrr-0.0.5...requestrr-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/requestrr/index.md b/docs/apps/stable/requestrr/index.md index c615b4c3a10..14e8ec28be1 100644 --- a/docs/apps/stable/requestrr/index.md +++ b/docs/apps/stable/requestrr/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/requestrr/security.md b/docs/apps/stable/requestrr/security.md index cdd7c198331..18c96551c78 100644 --- a/docs/apps/stable/requestrr/security.md +++ b/docs/apps/stable/requestrr/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-requestrr' of Deployment 'RELEASE-NAME-requestrr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/resilio-sync/CHANGELOG.md b/docs/apps/stable/resilio-sync/CHANGELOG.md index 3802a25a9e9..cc5091c875b 100644 --- a/docs/apps/stable/resilio-sync/CHANGELOG.md +++ b/docs/apps/stable/resilio-sync/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [resilio-sync-4.0.27](https://github.com/truecharts/apps/compare/resilio-sync-4.0.26...resilio-sync-4.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [resilio-sync-4.0.26](https://github.com/truecharts/apps/compare/resilio-sync-4.0.25...resilio-sync-4.0.26) (2021-12-21) diff --git a/docs/apps/stable/resilio-sync/index.md b/docs/apps/stable/resilio-sync/index.md index 0e7ed188cde..e3c2e2f4316 100644 --- a/docs/apps/stable/resilio-sync/index.md +++ b/docs/apps/stable/resilio-sync/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/rsnapshot/CHANGELOG.md b/docs/apps/stable/rsnapshot/CHANGELOG.md index ffe0a89ab5f..bd916d61f09 100644 --- a/docs/apps/stable/rsnapshot/CHANGELOG.md +++ b/docs/apps/stable/rsnapshot/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [rsnapshot-0.0.7](https://github.com/truecharts/apps/compare/rsnapshot-0.0.6...rsnapshot-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [rsnapshot-0.0.6](https://github.com/truecharts/apps/compare/rsnapshot-0.0.5...rsnapshot-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/rsnapshot/index.md b/docs/apps/stable/rsnapshot/index.md index 0523e1f46f4..173221cc6fa 100644 --- a/docs/apps/stable/rsnapshot/index.md +++ b/docs/apps/stable/rsnapshot/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/rsnapshot/security.md b/docs/apps/stable/rsnapshot/security.md index 6b606d7d894..5d1e60647e4 100644 --- a/docs/apps/stable/rsnapshot/security.md +++ b/docs/apps/stable/rsnapshot/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-rsnapshot' of Deployment 'RELEASE-NAME-rsnapshot' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/sabnzbd/CHANGELOG.md b/docs/apps/stable/sabnzbd/CHANGELOG.md index a92e668d6eb..4634afab622 100644 --- a/docs/apps/stable/sabnzbd/CHANGELOG.md +++ b/docs/apps/stable/sabnzbd/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [sabnzbd-9.0.26](https://github.com/truecharts/apps/compare/sabnzbd-9.0.25...sabnzbd-9.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [sabnzbd-9.0.25](https://github.com/truecharts/apps/compare/sabnzbd-9.0.24...sabnzbd-9.0.25) (2021-12-19) diff --git a/docs/apps/stable/sabnzbd/helm-values.md b/docs/apps/stable/sabnzbd/helm-values.md index 1f3fcbac836..8286fef015d 100644 --- a/docs/apps/stable/sabnzbd/helm-values.md +++ b/docs/apps/stable/sabnzbd/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/sabnzbd"` | | -| image.tag | string | `"v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d"` | | +| image.tag | string | `"v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | service.main.ports.main.port | int | `10097` | | diff --git a/docs/apps/stable/sabnzbd/index.md b/docs/apps/stable/sabnzbd/index.md index 89280013a2b..db13b20a72c 100644 --- a/docs/apps/stable/sabnzbd/index.md +++ b/docs/apps/stable/sabnzbd/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/sabnzbd/security.md b/docs/apps/stable/sabnzbd/security.md index 58604b84593..2008d046489 100644 --- a/docs/apps/stable/sabnzbd/security.md +++ b/docs/apps/stable/sabnzbd/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sabnzbd' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sabnzbd' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-sabnzbd' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/sabnzbd:v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d + tccr.io/truecharts/sabnzbd:v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/sabnzbd:v3.4.2@sha256:23f1fd8ff6709a1f11b08134f5463887efcfaa5aa1beadf32984d56b9b93c35d (ubuntu 20.04) +#### Container: tccr.io/truecharts/sabnzbd:v3.4.2@sha256:899d64a2006cccb885b2a1c7d41ad5b144de09b5e7c5017d9a714f39e8a25047 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -125,10 +117,10 @@ hide: | libpcre3 | CVE-2017-11164 | LOW | 2:8.39-12build1 | |
Expand...http://openwall.com/lists/oss-security/2017/07/11/3
http://www.securityfocus.com/bid/99575
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libpcre3 | CVE-2019-20838 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20838
https://linux.oracle.com/cve/CVE-2019-20838.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| | libpcre3 | CVE-2020-14155 | LOW | 2:8.39-12build1 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
http://seclists.org/fulldisclosure/2021/Feb/14
https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/
https://bugs.gentoo.org/717920
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155
https://linux.oracle.com/cve/CVE-2020-14155.html
https://linux.oracle.com/errata/ELSA-2021-4373.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/kb/HT211931
https://support.apple.com/kb/HT212147
https://www.pcre.org/original/changelog.txt
| -| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| libpython3.8-stdlib | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| libpython3.8-stdlib | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libroken18-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libsqlite3-0 | CVE-2020-9794 | MEDIUM | 3.31.1-4ubuntu0.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9794
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/HT211168
https://support.apple.com/HT211170
https://support.apple.com/HT211171
https://support.apple.com/HT211175
https://support.apple.com/HT211178
https://support.apple.com/HT211179
https://support.apple.com/HT211181
https://vuldb.com/?id.155768
| | libsqlite3-0 | CVE-2020-9849 | LOW | 3.31.1-4ubuntu0.2 | |
Expand...http://seclists.org/fulldisclosure/2020/Dec/32
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9849
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://support.apple.com/en-us/HT211843
https://support.apple.com/en-us/HT211844
https://support.apple.com/en-us/HT211850
https://support.apple.com/en-us/HT211931
https://support.apple.com/en-us/HT211935
https://support.apple.com/en-us/HT211952
https://www.rapid7.com/db/vulnerabilities/apple-osx-sqlite-cve-2020-9849/
| @@ -148,10 +140,10 @@ hide: | login | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | passwd | CVE-2013-4235 | LOW | 1:4.8.1-1ubuntu5.20.04.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | perl-base | CVE-2020-16156 | MEDIUM | 5.30.0-9ubuntu0.2 | |
Expand...http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
https://github.com/andk/cpanpm/commit/b27c51adf0fda25dee84cb72cb2b1bf7d832148c
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
| -| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.1 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| -| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8 | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8 | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| python3.8-minimal | CVE-2021-3737 | MEDIUM | 3.8.10-0ubuntu1~20.04.2 | |
Expand...https://bugs.python.org/issue44022
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737
https://github.com/python/cpython/commit/0389426fa4af4dfc8b1d7f3f291932d928392d8b (3.8 branch)
https://github.com/python/cpython/commit/078b146f062d212919d0ba25e34e658a8234aa63 (v3.7.11)
https://github.com/python/cpython/commit/1b6f4e5e13ebd1f957b47f7415b53d0869bdbac6 (v3.6.14
https://github.com/python/cpython/commit/5df4abd6b033a5f1e48945c6988b45e35e76f647 (v3.9.6)
https://github.com/python/cpython/commit/60ba0b68470a584103e28958d91e93a6db37ec92 (v3.10.0b2)
https://github.com/python/cpython/commit/98e5a7975d99b58d511f171816ecdfb13d5cca18 (v3.10.0b3)
https://github.com/python/cpython/commit/ea9327036680acc92d9f89eaf6f6a54d2f8d78d9 (v3.9.6)
https://github.com/python/cpython/commit/f396864ddfe914531b5856d7bf852808ebfc01ae (v3.8.11)
https://github.com/python/cpython/commit/f68d2d69f1da56c2aea1293ecf93ab69a6010ad7 (v3.6.14)
https://github.com/python/cpython/commit/fee96422e6f0056561cf74fef2012cc066c9db86 (v3.7.11)
https://github.com/python/cpython/pull/25916
https://github.com/python/cpython/pull/26503
https://linux.oracle.com/cve/CVE-2021-3737.html
https://linux.oracle.com/errata/ELSA-2021-4160.html
https://ubuntu.com/security/notices/USN-5083-1
| +| python3.8-minimal | CVE-2021-23336 | LOW | 3.8.10-0ubuntu1~20.04.2 | |
Expand...http://www.openwall.com/lists/oss-security/2021/02/19/4
http://www.openwall.com/lists/oss-security/2021/05/01/2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://github.com/python/cpython/commit/fcbe0cb04d35189401c0c880ebfb4311e952d776 (master)
https://github.com/python/cpython/pull/24297
https://linux.oracle.com/cve/CVE-2021-23336.html
https://linux.oracle.com/errata/ELSA-2021-4162.html
https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E
https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/
https://security.gentoo.org/glsa/202104-04
https://security.netapp.com/advisory/ntap-20210326-0004/
https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
https://ubuntu.com/security/notices/USN-4742-1
https://www.djangoproject.com/weblog/2021/feb/19/security-releases/
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | unrar | CVE-2018-25018 | MEDIUM | 1:5.6.6-2build1 | |
Expand...https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018
https://github.com/aawc/unrar/releases
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml
| **python-pkg** @@ -167,4 +159,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/scrutiny/CHANGELOG.md b/docs/apps/stable/scrutiny/CHANGELOG.md index c4069a182e4..ac146780eab 100644 --- a/docs/apps/stable/scrutiny/CHANGELOG.md +++ b/docs/apps/stable/scrutiny/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [scrutiny-0.0.8](https://github.com/truecharts/apps/compare/scrutiny-0.0.7...scrutiny-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [scrutiny-0.0.7](https://github.com/truecharts/apps/compare/scrutiny-0.0.6...scrutiny-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/scrutiny/index.md b/docs/apps/stable/scrutiny/index.md index ff18f0bc05b..0b734557a0e 100644 --- a/docs/apps/stable/scrutiny/index.md +++ b/docs/apps/stable/scrutiny/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/scrutiny/security.md b/docs/apps/stable/scrutiny/security.md index 618c6500998..4034b9c854e 100644 --- a/docs/apps/stable/scrutiny/security.md +++ b/docs/apps/stable/scrutiny/security.md @@ -21,12 +21,9 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV017 | Privileged container | HIGH |
Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.privileged' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv017
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-scrutiny' of Deployment 'RELEASE-NAME-scrutiny' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -85,6 +82,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -92,6 +90,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** @@ -99,3 +98,4 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/ser2sock/CHANGELOG.md b/docs/apps/stable/ser2sock/CHANGELOG.md index 1a0db237e0f..b2a3ae5456f 100644 --- a/docs/apps/stable/ser2sock/CHANGELOG.md +++ b/docs/apps/stable/ser2sock/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ser2sock-4.0.26](https://github.com/truecharts/apps/compare/ser2sock-4.0.25...ser2sock-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ser2sock-4.0.25](https://github.com/truecharts/apps/compare/ser2sock-4.0.24...ser2sock-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/ser2sock/index.md b/docs/apps/stable/ser2sock/index.md index d5296268e17..a045a4a5a85 100644 --- a/docs/apps/stable/ser2sock/index.md +++ b/docs/apps/stable/ser2sock/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/shiori/CHANGELOG.md b/docs/apps/stable/shiori/CHANGELOG.md index f56b0e529ae..d7138d84c4a 100644 --- a/docs/apps/stable/shiori/CHANGELOG.md +++ b/docs/apps/stable/shiori/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [shiori-4.0.17](https://github.com/truecharts/apps/compare/shiori-4.0.16...shiori-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [shiori-4.0.16](https://github.com/truecharts/apps/compare/shiori-4.0.15...shiori-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/shiori/index.md b/docs/apps/stable/shiori/index.md index 8c567f8d783..d9d36d277bc 100644 --- a/docs/apps/stable/shiori/index.md +++ b/docs/apps/stable/shiori/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/shiori/security.md b/docs/apps/stable/shiori/security.md index 2028c08dc88..55f43375355 100644 --- a/docs/apps/stable/shiori/security.md +++ b/docs/apps/stable/shiori/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -40,14 +36,8 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shiori' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-shiori' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/shiori:version-v1.5.0@sha256:6c6331888c9a5162def49b6212327242f7f5c96e2d5a1bb031f79321cc1c0549 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -326,7 +316,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20190701094942-4def268fd1a4 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| -| golang.org/x/crypto | CVE-2020-9283 | HIGH | v0.0.0-20190701094942-4def268fd1a4 | v0.0.0-20200220183623-bac4c82f6975 |
Expand...http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283
https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY
https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html
https://nvd.nist.gov/vuln/detail/CVE-2020-9283
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -361,7 +350,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/shorturl/CHANGELOG.md b/docs/apps/stable/shorturl/CHANGELOG.md index 2dbdd6fced5..72b163acfc6 100644 --- a/docs/apps/stable/shorturl/CHANGELOG.md +++ b/docs/apps/stable/shorturl/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [shorturl-1.0.26](https://github.com/truecharts/apps/compare/shorturl-1.0.25...shorturl-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [shorturl-1.0.25](https://github.com/truecharts/apps/compare/shorturl-1.0.24...shorturl-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/shorturl/index.md b/docs/apps/stable/shorturl/index.md index 6a1cdbd25df..ef493a90947 100644 --- a/docs/apps/stable/shorturl/index.md +++ b/docs/apps/stable/shorturl/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/shorturl/security.md b/docs/apps/stable/shorturl/security.md index 6779081007f..93d05d3b7b4 100644 --- a/docs/apps/stable/shorturl/security.md +++ b/docs/apps/stable/shorturl/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-shorturl' of Deployment 'RELEASE-NAME-shorturl' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/sickchill/CHANGELOG.md b/docs/apps/stable/sickchill/CHANGELOG.md index aa3dadcb013..b4fa7c79a3e 100644 --- a/docs/apps/stable/sickchill/CHANGELOG.md +++ b/docs/apps/stable/sickchill/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sickchill-1.0.26](https://github.com/truecharts/apps/compare/sickchill-1.0.25...sickchill-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sickchill-1.0.25](https://github.com/truecharts/apps/compare/sickchill-1.0.24...sickchill-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/sickchill/index.md b/docs/apps/stable/sickchill/index.md index ceff8c50883..a7136e89a8c 100644 --- a/docs/apps/stable/sickchill/index.md +++ b/docs/apps/stable/sickchill/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/sickchill/security.md b/docs/apps/stable/sickchill/security.md index a8210c3f828..ee88dcde250 100644 --- a/docs/apps/stable/sickchill/security.md +++ b/docs/apps/stable/sickchill/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickchill' of Deployment 'RELEASE-NAME-sickchill' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/sickgear/CHANGELOG.md b/docs/apps/stable/sickgear/CHANGELOG.md index c83a090f5b8..b9c6a18096d 100644 --- a/docs/apps/stable/sickgear/CHANGELOG.md +++ b/docs/apps/stable/sickgear/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sickgear-1.0.26](https://github.com/truecharts/apps/compare/sickgear-1.0.25...sickgear-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sickgear-1.0.25](https://github.com/truecharts/apps/compare/sickgear-1.0.24...sickgear-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/sickgear/index.md b/docs/apps/stable/sickgear/index.md index a9f492fbe13..18a8c11e4d6 100644 --- a/docs/apps/stable/sickgear/index.md +++ b/docs/apps/stable/sickgear/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/sickgear/security.md b/docs/apps/stable/sickgear/security.md index 99371ce184f..dae9ca8a688 100644 --- a/docs/apps/stable/sickgear/security.md +++ b/docs/apps/stable/sickgear/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sickgear' of Deployment 'RELEASE-NAME-sickgear' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/smokeping/CHANGELOG.md b/docs/apps/stable/smokeping/CHANGELOG.md index b8ce4f50d9b..801ff4eed14 100644 --- a/docs/apps/stable/smokeping/CHANGELOG.md +++ b/docs/apps/stable/smokeping/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [smokeping-1.0.28](https://github.com/truecharts/apps/compare/smokeping-1.0.27...smokeping-1.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [smokeping-1.0.27](https://github.com/truecharts/apps/compare/smokeping-1.0.26...smokeping-1.0.27) (2021-12-19) diff --git a/docs/apps/stable/smokeping/index.md b/docs/apps/stable/smokeping/index.md index 9eff26ae500..257c26fd259 100644 --- a/docs/apps/stable/smokeping/index.md +++ b/docs/apps/stable/smokeping/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/smokeping/security.md b/docs/apps/stable/smokeping/security.md index 16869f2f7f1..5e9c39bed9d 100644 --- a/docs/apps/stable/smokeping/security.md +++ b/docs/apps/stable/smokeping/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-smokeping' of Deployment 'RELEASE-NAME-smokeping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/snipe-it/CHANGELOG.md b/docs/apps/stable/snipe-it/CHANGELOG.md index ba4235474ca..499162fe50c 100644 --- a/docs/apps/stable/snipe-it/CHANGELOG.md +++ b/docs/apps/stable/snipe-it/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [snipe-it-0.0.18](https://github.com/truecharts/apps/compare/snipe-it-0.0.17...snipe-it-0.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [snipe-it-0.0.17](https://github.com/truecharts/apps/compare/snipe-it-0.0.16...snipe-it-0.0.17) (2021-12-19) diff --git a/docs/apps/stable/snipe-it/index.md b/docs/apps/stable/snipe-it/index.md index fad5bce5df6..784dbe48d49 100644 --- a/docs/apps/stable/snipe-it/index.md +++ b/docs/apps/stable/snipe-it/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/snipe-it/security.md b/docs/apps/stable/snipe-it/security.md index 1c0b484a6c7..e3823e982d0 100644 --- a/docs/apps/stable/snipe-it/security.md +++ b/docs/apps/stable/snipe-it/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-snipe-it' of Deployment 'RELEASE-NAME-snipe-it' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/snipe-it:v5.3.6@sha256:0d7df03b82dc909ba058e33153a307f3639741bef93616e59d3dd8ea4a413d45 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -101,8 +93,8 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| laravel/framework | CVE-2021-43808 | MEDIUM | v6.20.29 | 6.20.42, 7.30.6, 8.75.0 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| -| lcobucci/jwt | CVE-2021-41106 | LOW | 3.4.5 | 4.1.5, 3.4.6, 4.0.4 |
Expand...https://github.com/advisories/GHSA-7322-jrq4-x5hf
https://github.com/lcobucci/jwt/commit/8175de5b841fbe3fd97d2d49b3fc15c4ecb39a73
https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c
https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf
https://nvd.nist.gov/vuln/detail/CVE-2021-41106
| +| laravel/framework | CVE-2021-43808 | MEDIUM | v6.20.29 | 7.30.6, 8.75.0, 6.20.42 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43808
https://github.com/advisories/GHSA-66hf-2p6w-jqfw
https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
https://github.com/laravel/framework/pull/39906
https://github.com/laravel/framework/pull/39908
https://github.com/laravel/framework/pull/39909
https://github.com/laravel/framework/releases/tag/v6.20.42
https://github.com/laravel/framework/releases/tag/v7.30.6
https://github.com/laravel/framework/releases/tag/v8.75.0
https://github.com/laravel/framework/security/advisories/GHSA-66hf-2p6w-jqfw
| +| lcobucci/jwt | CVE-2021-41106 | LOW | 3.4.5 | 3.4.6, 4.0.4, 4.1.5 |
Expand...https://github.com/advisories/GHSA-7322-jrq4-x5hf
https://github.com/lcobucci/jwt/commit/8175de5b841fbe3fd97d2d49b3fc15c4ecb39a73
https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c
https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf
https://nvd.nist.gov/vuln/detail/CVE-2021-41106
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -137,7 +129,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/sonarr/CHANGELOG.md b/docs/apps/stable/sonarr/CHANGELOG.md index 9fe89928e3f..291966c5250 100644 --- a/docs/apps/stable/sonarr/CHANGELOG.md +++ b/docs/apps/stable/sonarr/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [sonarr-9.0.28](https://github.com/truecharts/apps/compare/sonarr-9.0.27...sonarr-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [sonarr-9.0.27](https://github.com/truecharts/apps/compare/sonarr-9.0.26...sonarr-9.0.27) (2021-12-20) diff --git a/docs/apps/stable/sonarr/helm-values.md b/docs/apps/stable/sonarr/helm-values.md index aa0f783ab9a..962506e047d 100644 --- a/docs/apps/stable/sonarr/helm-values.md +++ b/docs/apps/stable/sonarr/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/sonarr"` | | -| image.tag | string | `"v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a"` | | +| image.tag | string | `"v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | probes.liveness.custom | bool | `true` | | diff --git a/docs/apps/stable/sonarr/index.md b/docs/apps/stable/sonarr/index.md index 0cf79c6f661..5d9777b1dfa 100644 --- a/docs/apps/stable/sonarr/index.md +++ b/docs/apps/stable/sonarr/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/sonarr/security.md b/docs/apps/stable/sonarr/security.md index 25cd55ffa69..de50c5fb2c0 100644 --- a/docs/apps/stable/sonarr/security.md +++ b/docs/apps/stable/sonarr/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sonarr' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sonarr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-sonarr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a + tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:6a0f45517f706c877d7b5ae0605decf4993d7312920952aa7509b4cb003c137a (ubuntu 20.04) +#### Container: tccr.io/truecharts/sonarr:v3.0.6.1342@sha256:dcaf4d769b2c75422cd3ff230a39b5b8887c732f4622bf089c0da4e3dbbbde1e (ubuntu 20.04) **ubuntu** @@ -183,4 +180,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/speedtest-exporter/CHANGELOG.md b/docs/apps/stable/speedtest-exporter/CHANGELOG.md index 788b5d5f890..673031c9f78 100644 --- a/docs/apps/stable/speedtest-exporter/CHANGELOG.md +++ b/docs/apps/stable/speedtest-exporter/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [speedtest-exporter-1.0.13](https://github.com/truecharts/apps/compare/speedtest-exporter-1.0.12...speedtest-exporter-1.0.13) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [speedtest-exporter-1.0.12](https://github.com/truecharts/apps/compare/speedtest-exporter-1.0.11...speedtest-exporter-1.0.12) (2021-12-19) diff --git a/docs/apps/stable/speedtest-exporter/index.md b/docs/apps/stable/speedtest-exporter/index.md index a33053b21c9..6b09961b731 100644 --- a/docs/apps/stable/speedtest-exporter/index.md +++ b/docs/apps/stable/speedtest-exporter/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/speedtest-exporter/security.md b/docs/apps/stable/speedtest-exporter/security.md index 03f5cd9fd28..c9e6c437e4a 100644 --- a/docs/apps/stable/speedtest-exporter/security.md +++ b/docs/apps/stable/speedtest-exporter/security.md @@ -19,15 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-speedtest-exporter' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-speedtest-exporter' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-speedtest-exporter' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/sqlitebrowser/CHANGELOG.md b/docs/apps/stable/sqlitebrowser/CHANGELOG.md index ece7d7df8b6..6f5399f9d47 100644 --- a/docs/apps/stable/sqlitebrowser/CHANGELOG.md +++ b/docs/apps/stable/sqlitebrowser/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [sqlitebrowser-1.0.30](https://github.com/truecharts/apps/compare/sqlitebrowser-1.0.29...sqlitebrowser-1.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [sqlitebrowser-1.0.29](https://github.com/truecharts/apps/compare/sqlitebrowser-1.0.28...sqlitebrowser-1.0.29) (2021-12-19) diff --git a/docs/apps/stable/sqlitebrowser/index.md b/docs/apps/stable/sqlitebrowser/index.md index 7f5ce1ebbec..379f84d43c8 100644 --- a/docs/apps/stable/sqlitebrowser/index.md +++ b/docs/apps/stable/sqlitebrowser/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/sqlitebrowser/security.md b/docs/apps/stable/sqlitebrowser/security.md index 5cad81e6f8a..b1a1455a5e4 100644 --- a/docs/apps/stable/sqlitebrowser/security.md +++ b/docs/apps/stable/sqlitebrowser/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-sqlitebrowser' of Deployment 'RELEASE-NAME-sqlitebrowser' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -314,3 +310,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/stash/CHANGELOG.md b/docs/apps/stable/stash/CHANGELOG.md index 52e30ec44a4..93bcec95310 100644 --- a/docs/apps/stable/stash/CHANGELOG.md +++ b/docs/apps/stable/stash/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [stash-5.0.7](https://github.com/truecharts/apps/compare/stash-5.0.6...stash-5.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [stash-5.0.6](https://github.com/truecharts/apps/compare/stash-5.0.5...stash-5.0.6) (2021-12-19) diff --git a/docs/apps/stable/stash/index.md b/docs/apps/stable/stash/index.md index 23f5a123072..0c1e8485190 100644 --- a/docs/apps/stable/stash/index.md +++ b/docs/apps/stable/stash/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/stash/security.md b/docs/apps/stable/stash/security.md index d034525b0e7..490453cb891 100644 --- a/docs/apps/stable/stash/security.md +++ b/docs/apps/stable/stash/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-stash' of Deployment 'RELEASE-NAME-stash' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -95,5 +91,6 @@ hide: **gobinary** -| No Vulnerabilities found | -|:---------------------------------| +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/static/CHANGELOG.md b/docs/apps/stable/static/CHANGELOG.md index 9b69d2ca4d4..5c1e775dfa1 100644 --- a/docs/apps/stable/static/CHANGELOG.md +++ b/docs/apps/stable/static/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [static-1.0.26](https://github.com/truecharts/apps/compare/static-1.0.25...static-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [static-1.0.25](https://github.com/truecharts/apps/compare/static-1.0.24...static-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/static/index.md b/docs/apps/stable/static/index.md index 3c63b153137..c3dd0271756 100644 --- a/docs/apps/stable/static/index.md +++ b/docs/apps/stable/static/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/static/security.md b/docs/apps/stable/static/security.md index e0fe5229fd9..7b744a62e78 100644 --- a/docs/apps/stable/static/security.md +++ b/docs/apps/stable/static/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-static' of Deployment 'RELEASE-NAME-static' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/statping/CHANGELOG.md b/docs/apps/stable/statping/CHANGELOG.md index f93d558a48c..91728b26689 100644 --- a/docs/apps/stable/statping/CHANGELOG.md +++ b/docs/apps/stable/statping/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [statping-4.0.17](https://github.com/truecharts/apps/compare/statping-4.0.16...statping-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [statping-4.0.16](https://github.com/truecharts/apps/compare/statping-4.0.15...statping-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/statping/index.md b/docs/apps/stable/statping/index.md index b57f27770ec..efdb600f9c9 100644 --- a/docs/apps/stable/statping/index.md +++ b/docs/apps/stable/statping/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/statping/security.md b/docs/apps/stable/statping/security.md index 4545a37875e..3ea55d494d3 100644 --- a/docs/apps/stable/statping/security.md +++ b/docs/apps/stable/statping/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-statping' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-statping' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-statping' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/statping:v0.90.74@sha256:1c7e6cf35253668dd55ab20dde3c3e10d2fefd31416963b81d63846b672f38ce tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -392,6 +383,7 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -426,7 +418,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/synclounge/CHANGELOG.md b/docs/apps/stable/synclounge/CHANGELOG.md index e7b2fe6d558..c83dfa8d4a2 100644 --- a/docs/apps/stable/synclounge/CHANGELOG.md +++ b/docs/apps/stable/synclounge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [synclounge-0.0.7](https://github.com/truecharts/apps/compare/synclounge-0.0.6...synclounge-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [synclounge-0.0.6](https://github.com/truecharts/apps/compare/synclounge-0.0.5...synclounge-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/synclounge/index.md b/docs/apps/stable/synclounge/index.md index 5e17cd87046..6a59a24801b 100644 --- a/docs/apps/stable/synclounge/index.md +++ b/docs/apps/stable/synclounge/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/synclounge/security.md b/docs/apps/stable/synclounge/security.md index 0588f24c426..91e59c8f596 100644 --- a/docs/apps/stable/synclounge/security.md +++ b/docs/apps/stable/synclounge/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-synclounge' of Deployment 'RELEASE-NAME-synclounge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/syncthing/CHANGELOG.md b/docs/apps/stable/syncthing/CHANGELOG.md index 6f0e786da9d..3c71595871d 100644 --- a/docs/apps/stable/syncthing/CHANGELOG.md +++ b/docs/apps/stable/syncthing/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [syncthing-9.0.28](https://github.com/truecharts/apps/compare/syncthing-9.0.27...syncthing-9.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [syncthing-9.0.27](https://github.com/truecharts/apps/compare/syncthing-9.0.26...syncthing-9.0.27) (2021-12-19) diff --git a/docs/apps/stable/syncthing/index.md b/docs/apps/stable/syncthing/index.md index 932258d6db2..cb3f7f80adb 100644 --- a/docs/apps/stable/syncthing/index.md +++ b/docs/apps/stable/syncthing/index.md @@ -19,7 +19,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/syncthing/security.md b/docs/apps/stable/syncthing/security.md index 1346d0eee20..07c957a12bd 100644 --- a/docs/apps/stable/syncthing/security.md +++ b/docs/apps/stable/syncthing/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syncthing' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syncthing' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-syncthing' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/syslog-ng/CHANGELOG.md b/docs/apps/stable/syslog-ng/CHANGELOG.md index fcb9586069e..7bd11aca7cd 100644 --- a/docs/apps/stable/syslog-ng/CHANGELOG.md +++ b/docs/apps/stable/syslog-ng/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [syslog-ng-0.0.8](https://github.com/truecharts/apps/compare/syslog-ng-0.0.7...syslog-ng-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [syslog-ng-0.0.7](https://github.com/truecharts/apps/compare/syslog-ng-0.0.6...syslog-ng-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/syslog-ng/index.md b/docs/apps/stable/syslog-ng/index.md index 023e12a26da..f1eb03f38f7 100644 --- a/docs/apps/stable/syslog-ng/index.md +++ b/docs/apps/stable/syslog-ng/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/syslog-ng/security.md b/docs/apps/stable/syslog-ng/security.md index 10cf66a7480..0c5d3cd71b7 100644 --- a/docs/apps/stable/syslog-ng/security.md +++ b/docs/apps/stable/syslog-ng/security.md @@ -20,11 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-syslog-ng' of Deployment 'RELEASE-NAME-syslog-ng' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/tautulli/CHANGELOG.md b/docs/apps/stable/tautulli/CHANGELOG.md index 27137bf57bb..d5e62fba340 100644 --- a/docs/apps/stable/tautulli/CHANGELOG.md +++ b/docs/apps/stable/tautulli/CHANGELOG.md @@ -1,6 +1,16 @@ # Changelog
+ +### [tautulli-9.0.27](https://github.com/truecharts/apps/compare/tautulli-9.0.26...tautulli-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) +* update docker general non-major ([#1595](https://github.com/truecharts/apps/issues/1595)) + + + ### [tautulli-9.0.26](https://github.com/truecharts/apps/compare/tautulli-9.0.25...tautulli-9.0.26) (2021-12-20) diff --git a/docs/apps/stable/tautulli/helm-values.md b/docs/apps/stable/tautulli/helm-values.md index 2045b6e7a72..53cf7ca0dbf 100644 --- a/docs/apps/stable/tautulli/helm-values.md +++ b/docs/apps/stable/tautulli/helm-values.md @@ -14,7 +14,7 @@ You will, however, be able to use all values referenced in the common chart here | env | object | `{}` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.repository | string | `"tccr.io/truecharts/tautulli"` | | -| image.tag | string | `"v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6"` | | +| image.tag | string | `"v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234"` | | | persistence.config.enabled | bool | `true` | | | persistence.config.mountPath | string | `"/config"` | | | service.main.ports.main.port | int | `8181` | | diff --git a/docs/apps/stable/tautulli/index.md b/docs/apps/stable/tautulli/index.md index bae70af4b42..486d7651fda 100644 --- a/docs/apps/stable/tautulli/index.md +++ b/docs/apps/stable/tautulli/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/tautulli/security.md b/docs/apps/stable/tautulli/security.md index d810ac2e59d..935992f8dce 100644 --- a/docs/apps/stable/tautulli/security.md +++ b/docs/apps/stable/tautulli/security.md @@ -19,22 +19,19 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tautulli' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tautulli' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-tautulli' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/tautulli:v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6 + tccr.io/truecharts/tautulli:v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234 ##### Scan Results @@ -71,7 +68,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/tautulli:v2.8.0@sha256:2272501487483db1095edb1641f22c67af6d047316673d66bccb2d9cacadeff6 (ubuntu 20.04) +#### Container: tccr.io/truecharts/tautulli:v2.8.0@sha256:acf3f15104f723f57a1e2f73b4018a78e601349d91a5655bb2c8a8aa4d1aa234 (ubuntu 20.04) **ubuntu** @@ -80,11 +77,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | bash | CVE-2019-18276 | LOW | 5.0-6ubuntu1.1 | |
Expand...http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276
https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
https://linux.oracle.com/cve/CVE-2019-18276.html
https://linux.oracle.com/errata/ELSA-2021-1679.html
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security.gentoo.org/glsa/202105-34
https://security.netapp.com/advisory/ntap-20200430-0003/
https://www.youtube.com/watch?v=-wGtxJ8opa8
| -| bind9-dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-host | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| -| bind9-libs | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | coreutils | CVE-2016-2781 | LOW | 8.30-3ubuntu2 | |
Expand...http://seclists.org/oss-sec/2016/q1/452
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lore.kernel.org/patchwork/patch/793178/
| -| dnsutils | CVE-2021-25219 | MEDIUM | 1:9.16.1-0ubuntu2.8 | 1:9.16.1-0ubuntu2.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25219
https://kb.isc.org/docs/cve-2021-25219
https://kb.isc.org/v1/docs/cve-2021-25219
https://lists.debian.org/debian-lts-announce/2021/11/msg00001.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EF4NAVRV4H3W4GA3LGGZYUKD3HSJBAVW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YGV7SA27CTYLGFJSPUM3V36ZWK7WWDI4/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTKC4E3HUOLYN5IA4EBL4VAQSWG2ZVTX/
https://security.netapp.com/advisory/ntap-20211118-0002/
https://ubuntu.com/security/notices/USN-5126-1
https://ubuntu.com/security/notices/USN-5126-2
https://www.debian.org/security/2021/dsa-4994
| | libasn1-8-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libc-bin | CVE-2021-35942 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | libc-bin | CVE-2021-38604 | MEDIUM | 2.31-0ubuntu9.2 | |
Expand...https://blog.tuxcare.com/cve/tuxcare-team-identifies-cve-2021-38604-a-new-vulnerability-in-glibc
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38604
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GYEXYM37RCJWJ6B5KQUYQI4NZBDDYSXP/
https://security.netapp.com/advisory/ntap-20210909-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28213
https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641
https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8
| @@ -114,7 +107,6 @@ hide: | libheimbase1-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libheimntlm0-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| | libhx509-5-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| -| libicu66 | CVE-2021-30535 | MEDIUM | 66.1-2ubuntu2 | 66.1-2ubuntu2.1 |
Expand...https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html
https://crbug.com/1194899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30535
https://github.com/unicode-org/icu/pull/1698
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://ubuntu.com/security/notices/USN-5156-1
| | libk5crypto3 | CVE-2021-36222 | MEDIUM | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://linux.oracle.com/cve/CVE-2021-36222.html
https://linux.oracle.com/errata/ELSA-2021-3576.html
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
| | libk5crypto3 | CVE-2018-5709 | LOW | 1.17-6ubuntu4.1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
| | libkrb5-26-heimdal | CVE-2021-3671 | LOW | 7.7.0+dfsg-1ubuntu1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2013080,
https://bugzilla.samba.org/show_bug.cgi?id=14770,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://github.com/heimdal/heimdal/commit/04171147948d0a3636bc6374181926f0fb2ec83a
https://ubuntu.com/security/notices/USN-5142-1
https://ubuntu.com/security/notices/USN-5174-1
| @@ -166,4 +158,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/teamspeak3/CHANGELOG.md b/docs/apps/stable/teamspeak3/CHANGELOG.md index b938a81c37f..c3e61dc44b6 100644 --- a/docs/apps/stable/teamspeak3/CHANGELOG.md +++ b/docs/apps/stable/teamspeak3/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [teamspeak3-2.0.26](https://github.com/truecharts/apps/compare/teamspeak3-2.0.25...teamspeak3-2.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [teamspeak3-2.0.25](https://github.com/truecharts/apps/compare/teamspeak3-2.0.24...teamspeak3-2.0.25) (2021-12-19) diff --git a/docs/apps/stable/teamspeak3/index.md b/docs/apps/stable/teamspeak3/index.md index e10d15f04f5..b9efeafa738 100644 --- a/docs/apps/stable/teamspeak3/index.md +++ b/docs/apps/stable/teamspeak3/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/teamspeak3/security.md b/docs/apps/stable/teamspeak3/security.md index 98d58e6049e..ef6d92df3a9 100644 --- a/docs/apps/stable/teamspeak3/security.md +++ b/docs/apps/stable/teamspeak3/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teamspeak3' of Deployment 'RELEASE-NAME-teamspeak3' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/teedy/CHANGELOG.md b/docs/apps/stable/teedy/CHANGELOG.md index b8cf718b3ff..0a921f9a08b 100644 --- a/docs/apps/stable/teedy/CHANGELOG.md +++ b/docs/apps/stable/teedy/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [teedy-4.0.17](https://github.com/truecharts/apps/compare/teedy-4.0.16...teedy-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [teedy-4.0.16](https://github.com/truecharts/apps/compare/teedy-4.0.15...teedy-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/teedy/index.md b/docs/apps/stable/teedy/index.md index 123cf11b8c8..5434ee03243 100644 --- a/docs/apps/stable/teedy/index.md +++ b/docs/apps/stable/teedy/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/teedy/security.md b/docs/apps/stable/teedy/security.md index 8bc313af444..9920674261a 100644 --- a/docs/apps/stable/teedy/security.md +++ b/docs/apps/stable/teedy/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-teedy' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-teedy' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-teedy' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/docs:v1.9@sha256:23e9053e5eb837b31ae08bc770865827c7a2dc49dfc46fa2eba55f18fe8b21da tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -1601,8 +1592,8 @@ hide: | com.squareup.okhttp3:okhttp | CVE-2018-20200 | MEDIUM | 3.11.0 | 3.12.1 |
Expand...https://cxsecurity.com/issue/WLB-2018120252
https://github.com/square/okhttp/commits/master
https://github.com/square/okhttp/issues/4967
https://github.com/square/okhttp/releases
https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0dd7ff197b2e3bdd80a0326587ca3d0c22e10d1dba17c769d6da7d7a@%3Cuser.flink.apache.org%3E
https://lists.apache.org/thread.html/r71100f23778d72fbd8be8baa6baffc159b9c4f3fae3db4826bdc8ab8@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r78bfce980843be61a55615a7680bbf7ac751a9b3515231eab2d32068@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rc436d58531754ac8fe20340044566518ea4dce66aeff9193356a225d@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/recce57e195fbdd856dcf1933c136a8a66d7b02e05e3580f44d75a640@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rfd1eed12ba2a5dff37229edd60fc84a25517815d848994146a15af91@%3Cissues.flink.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2018-20200
https://square.github.io/okhttp/3.x/okhttp/
| | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.6 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | log4j:log4j | CVE-2019-17571 | CRITICAL | 1.2.16 | 2.0-alpha1 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571
https://github.com/advisories/GHSA-2qrg-x229-3v8q
https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E
https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E
https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E
https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E
https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E
https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E
https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E
https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E
https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E
https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html
https://nvd.nist.gov/vuln/detail/CVE-2019-17571
https://security.netapp.com/advisory/ntap-20200110-0001/
https://ubuntu.com/security/notices/USN-4495-1
https://usn.ubuntu.com/4495-1/
https://www.debian.org/security/2020/dsa-4686
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujul2020.html
| -| log4j:log4j | CVE-2021-4104 | HIGH | 1.2.16 | |
Expand...https://access.redhat.com/security/cve/CVE-2021-4104
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
https://github.com/advisories/GHSA-fp5r-v3w9-4333
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
https://nvd.nist.gov/vuln/detail/CVE-2021-4104
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/13/1
| -| log4j:log4j | CVE-2020-9488 | LOW | 1.2.16 | 2.13.2 |
Expand...https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| +| log4j:log4j | CVE-2021-4104 | HIGH | 1.2.16 | |
Expand...https://access.redhat.com/security/cve/CVE-2021-4104
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4104
https://github.com/advisories/GHSA-fp5r-v3w9-4333
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://github.com/apache/logging-log4j2/pull/608#issuecomment-991723301
https://linux.oracle.com/cve/CVE-2021-4104.html
https://linux.oracle.com/errata/ELSA-2021-5206.html
https://lists.apache.org/thread/0x4zvtq92yggdgvwfgsftqrj4xx5w0nx
https://nvd.nist.gov/vuln/detail/CVE-2021-4104
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/13/1
https://www.openwall.com/lists/oss-security/2021/12/13/2
| +| log4j:log4j | CVE-2020-9488 | LOW | 1.2.16 | 2.13.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9488
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=6851b5083ef9610bae320bf07e1f24d2aa08851b (release-2.x)
https://gitbox.apache.org/repos/asf?p=logging-log4j2.git;h=fb91a3d71e2f3dadad6fd1beb2ab857f44fe8bbb (master)
https://github.com/advisories/GHSA-vwqq-5vrc-xw9h
https://issues.apache.org/jira/browse/LOG4J2-2819
https://lists.apache.org/thread.html/r0a2699f724156a558afd1abb6c044fb9132caa66dce861b82699722a@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r0df3d7a5acb98c57e64ab9266aa21eeee1d9b399addb96f9cf1cbe05@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r1fc73f0e16ec2fa249d3ad39a5194afb9cc5afb4c023dc0bab5a5881@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r22a56beb76dd8cf18e24fda9072f1e05990f49d6439662d3782a392f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r2f209d271349bafd91537a558a279c08ebcff8fa3e547357d58833e6@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r33864a0fc171c1c4bf680645ebb6d4f8057899ab294a43e1e4fe9d04@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r393943de452406f0f6f4b3def9f8d3c071f96323c1f6ed1a098f7fe4@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/r3d1d00441c55144a4013adda74b051ae7864128ebcfb6ee9721a2eb3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r4285398e5585a0456d3d9db021a4fce6e6fcf3ec027dfa13a450ec98@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r45916179811a32cbaa500f972de9098e6ee80ee81c7f134fce83e03a@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r48bcd06049c1779ef709564544c3d8a32ae6ee5c3b7281a606ac4463@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r4d5dc9f3520071338d9ebc26f9f158a43ae28a91923d176b550a807b@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4db540cafc5d7232c62e076051ef661d37d345015b2e59b3f81a932f@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r4ed1f49616a8603832d378cb9d13e7a8b9b27972bb46d946ccd8491f@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r5a68258e5ab12532dc179edae3d6e87037fa3b50ab9d63a90c432507@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r65578f3761a89bc164e8964acd5d913b9f8fd997967b195a89a97ca3@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r7641ee788e1eb1be4bb206a7d15f8a64ec6ef23e5ec6132d5a567695@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/r7e739f2961753af95e2a3a637828fb88bfca68e5d6b0221d483a9ee5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8c001b9a95c0bbec06f4457721edd94935a55932e64b82cc5582b846@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E
https://lists.apache.org/thread.html/r9776e71e3c67c5d13a91c1eba0dc025b48b802eb7561cc6956d6961c@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r9a79175c393d14d760a0ae3731b4a873230a16ef321aa9ca48a810cd@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra051e07a0eea4943fa104247e69596f094951f51512d42c924e86c75@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/ra632b329b2ae2324fabbad5da204c4ec2e171ff60348ec4ba698fd40@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc2dbc4633a6eea1fcbce6831876cfa17b73759a98c65326d1896cb1a@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rc6b81c013618d1de1b5d6b8c1088aaf87b4bacc10c2371f15a566701@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd55f65c6822ff235eda435d31488cfbb9aa7055cdf47481ebee777cc@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd5d58088812cf8e677d99b07f73c654014c524c94e7fedbdee047604@%3Ctorque-dev.db.apache.org%3E
https://lists.apache.org/thread.html/rd8e87c4d69df335d0ba7d815b63be8bd8a6352f429765c52eb07ddac@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rf1c2a81a08034c688b8f15cf58a4cfab322d00002ca46d20133bee20@%3Cdev.kafka.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-9488
https://security.netapp.com/advisory/ntap-20200504-0003/
https://www.debian.org/security/2021/dsa-5020
https://www.openwall.com/lists/oss-security/2020/04/25/1
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | log4j:log4j | GMS-2021-5 | UNKNOWN | 1.2.16 | 2.15.0-rc1 |
Expand...https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://www.lunasec.io/docs/blog/log4j-zero-day/
| | org.apache.commons:commons-compress | CVE-2019-12402 | HIGH | 1.18 | 1.19 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12402
https://github.com/advisories/GHSA-53x6-4x5p-rrvv
https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/54cc4e9fa6b24520135f6fa4724dfb3465bc14703c7dc7e52353a0ea@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/r05cf37c1e1e662e968cfece1102fcd50fe207181fdbf2c30aadfafd3@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/r21d64797914001119d2fc766b88c6da181dc2308d20f14e7a7f46117@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r233267e24519bacd0f9fb9f61a1287cb9f4bcb6e75d83f34f405c521@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r25422df9ad22fec56d9eeca3ab8bd6d66365e9f6bfe311b64730edf5@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r4363c994c8bca033569a98da9218cc0c62bb695c1e47a98e5084e5a0@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r5103b1c9242c0f812ac96e524344144402cbff9b6e078d1557bc7b1e@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r590c15cebee9b8e757e2f738127a9a71e48ede647a3044c504e050a4@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r5caf4fcb69d2749225391e61db7216282955204849ba94f83afe011f@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53@%3Cdev.brooklyn.apache.org%3E
https://lists.apache.org/thread.html/r972f82d821b805d04602976a9736c01b6bf218cfe0c3f48b472db488@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rcc35ab6be300365de5ff9587e0479d10d7d7c79070921837e3693162@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rd3f99d732baed459b425fb0a9e9e14f7843c9459b12037e4a9d753b5@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rdebc1830d6c09c11d5a4804ca26769dbd292d17d361c61dea50915f0@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/re13bd219dd4b651134f6357f12bd07a0344eea7518c577bbdd185265@%3Cissues.flink.apache.org%3E
https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55@%3Csolr-user.lucene.apache.org%3E
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QLJIK2AUOZOWXR3S5XXBUNMOF3RTHTI7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZB3GB7YXIOUKIOQ27VTIP6KKGJJ3CKL/
https://nvd.nist.gov/vuln/detail/CVE-2019-12402
https://www.openwall.com/lists/oss-security/2019/08/27/1
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuapr2020.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| | org.apache.commons:commons-compress | CVE-2021-35515 | HIGH | 1.18 | 1.21 |
Expand...http://www.openwall.com/lists/oss-security/2021/07/13/1
https://commons.apache.org/proper/commons-compress/security-reports.html
https://github.com/advisories/GHSA-7hfm-57qf-j43q
https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E
https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E
https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-35515
https://security.netapp.com/advisory/ntap-20211022-0001/
https://www.oracle.com/security-alerts/cpuoct2021.html
| @@ -1683,7 +1674,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/thelounge/CHANGELOG.md b/docs/apps/stable/thelounge/CHANGELOG.md index 4eb088ad778..925e7eefd1d 100644 --- a/docs/apps/stable/thelounge/CHANGELOG.md +++ b/docs/apps/stable/thelounge/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [thelounge-4.0.28](https://github.com/truecharts/apps/compare/thelounge-4.0.27...thelounge-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [thelounge-4.0.27](https://github.com/truecharts/apps/compare/thelounge-4.0.26...thelounge-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/thelounge/index.md b/docs/apps/stable/thelounge/index.md index 987a63d6cab..1cd552d8038 100644 --- a/docs/apps/stable/thelounge/index.md +++ b/docs/apps/stable/thelounge/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/thelounge/security.md b/docs/apps/stable/thelounge/security.md index b7727a9ad47..76c3db57f25 100644 --- a/docs/apps/stable/thelounge/security.md +++ b/docs/apps/stable/thelounge/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-thelounge' of Deployment 'RELEASE-NAME-thelounge' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -710,7 +706,7 @@ hide: | linux-libc-dev | CVE-2021-3864 | HIGH | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4028 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
https://lkml.org/lkml/2021/10/4/697
| | linux-libc-dev | CVE-2021-4083 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 5.10.70-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 5.10.70-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -722,7 +718,7 @@ hide: | linux-libc-dev | CVE-2020-15802 | MEDIUM | 5.10.70-1 | |
Expand...https://arxiv.org/abs/2009.11776
https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709
https://hexhive.epfl.ch/BLURtooth/
https://securityaffairs.co/wordpress/108096/hacking/blurtooth-bluetooth-attack.html
https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth/
https://www.kb.cert.org/vuls/id/589825
https://www.kb.cert.org/vuls/id/589825/
| | linux-libc-dev | CVE-2020-24504 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24504
https://linux.oracle.com/cve/CVE-2020-24504.html
https://linux.oracle.com/errata/ELSA-2021-4356.html
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
| | linux-libc-dev | CVE-2020-26555 | MEDIUM | 5.10.70-1 | |
Expand...https://kb.cert.org/vuls/id/799380
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/
https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| | linux-libc-dev | CVE-2021-3744 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3744
https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0
https://linux.oracle.com/cve/CVE-2021-3744.html
https://linux.oracle.com/errata/ELSA-2021-9565.html
https://seclists.org/oss-sec/2021/q3/164
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
https://ubuntu.com/security/notices/USN-5161-1
https://ubuntu.com/security/notices/USN-5162-1
https://ubuntu.com/security/notices/USN-5163-1
https://ubuntu.com/security/notices/USN-5164-1
| @@ -732,15 +728,17 @@ hide: | linux-libc-dev | CVE-2021-3847 | MEDIUM | 5.10.70-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| | linux-libc-dev | CVE-2021-4001 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4001
https://git.kernel.org/linus/353050be4c19e102178ccc05988101887c25ae53
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=353050be4c19e102178ccc05988101887c25ae53
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42327 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42327
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7/
https://lists.freedesktop.org/archives/amd-gfx/2021-October/070170.html
https://security.netapp.com/advisory/ntap-20211118-0005/
https://ubuntu.com/security/notices/USN-5165-1
https://www.mail-archive.com/amd-gfx@lists.freedesktop.org/msg69080.html
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43056 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/10/28/1
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43056
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://git.kernel.org/linus/cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 (5.15-rc6)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AA7EAPPKWG4LMTQQLNNSKATY6ST2KQFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBM4FP3IT3JZ2O7EBS7TEOG657N4ZGRE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RRAIS3PG4EV5WFLYESR6FXWM4BJJGWVA/
https://lore.kernel.org/linuxppc-dev/87pmrtbbdt.fsf@mpe.ellerman.id.au/T/#u
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 5.10.70-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 5.10.70-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 5.10.70-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 5.10.70-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -783,7 +781,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 5.10.70-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 5.10.70-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 5.10.70-1 | 5.10.84-1 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 5.10.70-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 5.10.70-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 5.10.70-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.8.1-1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.8.1-1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2019-19882 | LOW | 1:4.8.1-1 | |
Expand...https://bugs.archlinux.org/task/64836
https://bugs.gentoo.org/702252
https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
https://github.com/shadow-maint/shadow/pull/199
https://github.com/void-linux/void-packages/pull/17580
https://security.gentoo.org/glsa/202008-09
| diff --git a/docs/apps/stable/traccar/CHANGELOG.md b/docs/apps/stable/traccar/CHANGELOG.md index 8b9e20a2377..0fe73adc246 100644 --- a/docs/apps/stable/traccar/CHANGELOG.md +++ b/docs/apps/stable/traccar/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [traccar-4.0.17](https://github.com/truecharts/apps/compare/traccar-4.0.16...traccar-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [traccar-4.0.16](https://github.com/truecharts/apps/compare/traccar-4.0.15...traccar-4.0.16) (2021-12-19) diff --git a/docs/apps/stable/traccar/index.md b/docs/apps/stable/traccar/index.md index dbf87a418eb..1afffb6b34f 100644 --- a/docs/apps/stable/traccar/index.md +++ b/docs/apps/stable/traccar/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/traccar/security.md b/docs/apps/stable/traccar/security.md index a646432ca4c..03322f09265 100644 --- a/docs/apps/stable/traccar/security.md +++ b/docs/apps/stable/traccar/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traccar' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-traccar' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traccar' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/traccar:v4.14@sha256:39fe3c8c65caef00ab79591c98b383432fe2d21bf745c925df6fd7891ce6fe78 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -415,7 +406,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/transmission/CHANGELOG.md b/docs/apps/stable/transmission/CHANGELOG.md index 0be17ac41a0..72c9a9a5798 100644 --- a/docs/apps/stable/transmission/CHANGELOG.md +++ b/docs/apps/stable/transmission/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [transmission-10.0.7](https://github.com/truecharts/apps/compare/transmission-10.0.6...transmission-10.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [transmission-10.0.6](https://github.com/truecharts/apps/compare/transmission-10.0.5...transmission-10.0.6) (2021-12-19) diff --git a/docs/apps/stable/transmission/index.md b/docs/apps/stable/transmission/index.md index 7994eef2483..31693b468e6 100644 --- a/docs/apps/stable/transmission/index.md +++ b/docs/apps/stable/transmission/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/transmission/security.md b/docs/apps/stable/transmission/security.md index 37f2833d636..bac3fe5ca8d 100644 --- a/docs/apps/stable/transmission/security.md +++ b/docs/apps/stable/transmission/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-transmission' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-transmission' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-transmission' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -172,4 +169,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/truecommand/CHANGELOG.md b/docs/apps/stable/truecommand/CHANGELOG.md index 6bf21ebc491..f777a8b47a8 100644 --- a/docs/apps/stable/truecommand/CHANGELOG.md +++ b/docs/apps/stable/truecommand/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [truecommand-9.0.27](https://github.com/truecharts/apps/compare/truecommand-9.0.26...truecommand-9.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [truecommand-9.0.26](https://github.com/truecharts/apps/compare/truecommand-9.0.25...truecommand-9.0.26) (2021-12-19) diff --git a/docs/apps/stable/truecommand/index.md b/docs/apps/stable/truecommand/index.md index 5ae473e45fd..b6145b1e0cd 100644 --- a/docs/apps/stable/truecommand/index.md +++ b/docs/apps/stable/truecommand/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/truecommand/security.md b/docs/apps/stable/truecommand/security.md index 26d2846846f..ff89f63bd28 100644 --- a/docs/apps/stable/truecommand/security.md +++ b/docs/apps/stable/truecommand/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-truecommand' of Deployment 'RELEASE-NAME-truecommand' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -400,22 +396,22 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/buger/jsonparser | CVE-2020-10675 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v0.0.0-20200321185410-91ac96899e49 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10675
https://github.com/buger/jsonparser/issues/188
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/
https://nvd.nist.gov/vuln/detail/CVE-2020-10675
| -| github.com/buger/jsonparser | CVE-2020-35381 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v1.1.1 |
Expand...https://github.com/buger/jsonparser/issues/219
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27EA7OGCELV7QFAGVIHODHWKMKGFVIUZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJO5N7YTDEUSTKYTNA372CE6VHCZJWUG/
https://nvd.nist.gov/vuln/detail/CVE-2020-35381
| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | v1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| +| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | 1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| **gobinary** | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| github.com/buger/jsonparser | CVE-2020-10675 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v0.0.0-20200321185410-91ac96899e49 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10675
https://github.com/buger/jsonparser/issues/188
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4C7PV6KEUUM76V4B2J5IFN2U6LEOWB67/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KUHKDQSEYJNROA66OMN6AAQMGAAN6WI/
https://nvd.nist.gov/vuln/detail/CVE-2020-10675
| -| github.com/buger/jsonparser | CVE-2020-35381 | HIGH | v0.0.0-20191004114745-ee4c978eae7e | v1.1.1 |
Expand...https://github.com/buger/jsonparser/issues/219
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27EA7OGCELV7QFAGVIHODHWKMKGFVIUZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJO5N7YTDEUSTKYTNA372CE6VHCZJWUG/
https://nvd.nist.gov/vuln/detail/CVE-2020-35381
| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| -| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | v1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| +| github.com/gogo/protobuf | CVE-2021-3121 | HIGH | v1.3.1 | 1.3.2 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
https://discuss.hashicorp.com/t/hcsec-2021-23-consul-exposed-to-denial-of-service-in-gogo-protobuf-dependency/29025
https://github.com/gogo/protobuf/commit/b03c65ea87cdc3521ede29f62fe3ce239267c1bc
https://github.com/gogo/protobuf/compare/v1.3.1...v1.3.2
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://lists.apache.org/thread.html/r88d69555cb74a129a7bf84838073b61259b4a3830190e05a3b87994e@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rc1e9ff22c5641d73701ba56362fb867d40ed287cca000b131dcf4a44@%3Ccommits.pulsar.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2021-3121
https://security.netapp.com/advisory/ntap-20210219-0006/
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| **gobinary** @@ -423,6 +419,7 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| **gobinary** diff --git a/docs/apps/stable/tt-rss/CHANGELOG.md b/docs/apps/stable/tt-rss/CHANGELOG.md index 45dfacd1c3d..bfffd7a890f 100644 --- a/docs/apps/stable/tt-rss/CHANGELOG.md +++ b/docs/apps/stable/tt-rss/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tt-rss-4.0.26](https://github.com/truecharts/apps/compare/tt-rss-4.0.25...tt-rss-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tt-rss-4.0.25](https://github.com/truecharts/apps/compare/tt-rss-4.0.24...tt-rss-4.0.25) (2021-12-20) diff --git a/docs/apps/stable/tt-rss/index.md b/docs/apps/stable/tt-rss/index.md index 151597ca993..f82f0be63db 100644 --- a/docs/apps/stable/tt-rss/index.md +++ b/docs/apps/stable/tt-rss/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/tt-rss/security.md b/docs/apps/stable/tt-rss/security.md index d4c203c55b7..f2736b6ba81 100644 --- a/docs/apps/stable/tt-rss/security.md +++ b/docs/apps/stable/tt-rss/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tt-rss' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-tt-rss' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/tt-rss:v1.9082.0@sha256:20322392e459f2e35f67a855449416dabe335bbe4d9d4b657dcf2f998fa38558 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -464,7 +454,9 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| #### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) @@ -499,7 +491,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/tvheadend/CHANGELOG.md b/docs/apps/stable/tvheadend/CHANGELOG.md index 8446cdac537..c15d0f3aa9c 100644 --- a/docs/apps/stable/tvheadend/CHANGELOG.md +++ b/docs/apps/stable/tvheadend/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [tvheadend-10.0.26](https://github.com/truecharts/apps/compare/tvheadend-10.0.25...tvheadend-10.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [tvheadend-10.0.25](https://github.com/truecharts/apps/compare/tvheadend-10.0.24...tvheadend-10.0.25) (2021-12-19) diff --git a/docs/apps/stable/tvheadend/index.md b/docs/apps/stable/tvheadend/index.md index 11c5b9c52a2..b208d81574b 100644 --- a/docs/apps/stable/tvheadend/index.md +++ b/docs/apps/stable/tvheadend/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/tvheadend/security.md b/docs/apps/stable/tvheadend/security.md index 232ccc2d222..34f7412390f 100644 --- a/docs/apps/stable/tvheadend/security.md +++ b/docs/apps/stable/tvheadend/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-tvheadend' of Deployment 'RELEASE-NAME-tvheadend' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/twtxt/CHANGELOG.md b/docs/apps/stable/twtxt/CHANGELOG.md index 5f1e73ef8db..b99a042a698 100644 --- a/docs/apps/stable/twtxt/CHANGELOG.md +++ b/docs/apps/stable/twtxt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [twtxt-1.0.26](https://github.com/truecharts/apps/compare/twtxt-1.0.25...twtxt-1.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [twtxt-1.0.25](https://github.com/truecharts/apps/compare/twtxt-1.0.24...twtxt-1.0.25) (2021-12-19) diff --git a/docs/apps/stable/twtxt/index.md b/docs/apps/stable/twtxt/index.md index b76f602eb6e..bf0bb5d0685 100644 --- a/docs/apps/stable/twtxt/index.md +++ b/docs/apps/stable/twtxt/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/twtxt/security.md b/docs/apps/stable/twtxt/security.md index 4bc59cfecc6..31a0954bedd 100644 --- a/docs/apps/stable/twtxt/security.md +++ b/docs/apps/stable/twtxt/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-twtxt' of Deployment 'RELEASE-NAME-twtxt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -84,3 +80,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/dgrijalva/jwt-go | CVE-2020-26160 | HIGH | v3.2.0+incompatible | |
Expand...https://github.com/dgrijalva/jwt-go/pull/426
https://nvd.nist.gov/vuln/detail/CVE-2020-26160
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDGRIJALVAJWTGO-596515
| | golang.org/x/crypto | CVE-2020-29652 | HIGH | v0.0.0-20200709230013-948cd5f35899 | v0.0.0-20201216223049-8b5274cf687f |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652
https://go-review.googlesource.com/c/crypto/+/278852
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
https://linux.oracle.com/cve/CVE-2020-29652.html
https://linux.oracle.com/errata/ELSA-2021-1796.html
https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-29652
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.3 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/ubooquity/CHANGELOG.md b/docs/apps/stable/ubooquity/CHANGELOG.md index b445118d718..d69cda3b17f 100644 --- a/docs/apps/stable/ubooquity/CHANGELOG.md +++ b/docs/apps/stable/ubooquity/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [ubooquity-0.0.7](https://github.com/truecharts/apps/compare/ubooquity-0.0.6...ubooquity-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [ubooquity-0.0.6](https://github.com/truecharts/apps/compare/ubooquity-0.0.5...ubooquity-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/ubooquity/index.md b/docs/apps/stable/ubooquity/index.md index 2e6d8d808d4..4c872760c72 100644 --- a/docs/apps/stable/ubooquity/index.md +++ b/docs/apps/stable/ubooquity/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/ubooquity/security.md b/docs/apps/stable/ubooquity/security.md index da7a59fe5e5..c5100765a69 100644 --- a/docs/apps/stable/ubooquity/security.md +++ b/docs/apps/stable/ubooquity/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-ubooquity' of Deployment 'RELEASE-NAME-ubooquity' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/unifi/CHANGELOG.md b/docs/apps/stable/unifi/CHANGELOG.md index 6d4adca99cf..33087dd6b05 100644 --- a/docs/apps/stable/unifi/CHANGELOG.md +++ b/docs/apps/stable/unifi/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unifi-9.0.30](https://github.com/truecharts/apps/compare/unifi-9.0.29...unifi-9.0.30) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unifi-9.0.29](https://github.com/truecharts/apps/compare/unifi-9.0.28...unifi-9.0.29) (2021-12-19) diff --git a/docs/apps/stable/unifi/index.md b/docs/apps/stable/unifi/index.md index 764c8b2bf21..14012b38cc6 100644 --- a/docs/apps/stable/unifi/index.md +++ b/docs/apps/stable/unifi/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/unifi/security.md b/docs/apps/stable/unifi/security.md index b0cf6572347..b2c8d688be1 100644 --- a/docs/apps/stable/unifi/security.md +++ b/docs/apps/stable/unifi/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unifi' of Deployment 'RELEASE-NAME-unifi' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -240,7 +236,7 @@ hide: | commons-io:commons-io | CVE-2021-29425 | MEDIUM | 2.6 | 2.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425
https://github.com/advisories/GHSA-gwrp-pvrq-jmwv
https://issues.apache.org/jira/browse/IO-556
https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E
https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E
https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E
https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E
https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E
https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E
https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2021-29425
https://ubuntu.com/security/notices/USN-5095-1
https://www.openwall.com/lists/oss-security/2021/04/12/1
https://www.oracle.com/security-alerts/cpuoct2021.html
| | io.springfox:springfox-swagger-ui | CVE-2019-17495 | CRITICAL | 2.9.2 | 2.10.0 |
Expand...https://github.com/advisories/GHSA-c427-hjc3-wrfw
https://github.com/swagger-api/swagger-ui/releases/tag/v3.23.11
https://github.com/tarantula-team/CSS-injection-in-Swagger-UI
https://lists.apache.org/thread.html/r103579b01da2d0aa0f672b88f811224bbf8ef493aaad845895955e91@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r3acb7e494cf1aab99b6784b7c5bbddfd0d4f8a484ab534c3a61ef9cf@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r84b327f7a8b6b28857b906c07a66dd98e1d341191fa8d7816514ef96@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/r853ffeb915a400f899de78124d4e0d77a19379d2e11bf8f4e98c624f@%3Ccommits.airflow.apache.org%3E
https://lists.apache.org/thread.html/ref70b940c4f69560d29d6ba792d6c82865e74de3dcad4c92d99b1f8f@%3Ccommits.airflow.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-17495
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
| | org.apache.httpcomponents:httpclient | CVE-2020-13956 | MEDIUM | 4.5.10 | 4.5.13 |
Expand...https://github.com/advisories/GHSA-7r82-7xv7-xcpj
https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E
https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E
https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E
https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E
https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E
https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E
https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E
https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E
https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E
https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E
https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E
https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E
https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E
https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E
https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
https://www.openwall.com/lists/oss-security/2020/10/08/4
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| -| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://logging.apache.org/log4j/2.x/security.html
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| +| org.apache.logging.log4j:log4j-api | CVE-2021-45105 | HIGH | 2.16.0 | 2.17.0, 2.12.3 |
Expand...http://www.openwall.com/lists/oss-security/2021/12/19/1
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105
https://github.com/advisories/GHSA-p6xc-xr62-6r2g
https://issues.apache.org/jira/browse/LOG4J2-3230
https://logging.apache.org/log4j/2.x/security.html
https://logging.apache.org/log4j/2.x/security.html#CVE-2021-45105
https://nvd.nist.gov/vuln/detail/CVE-2021-45105
https://security.netapp.com/advisory/ntap-20211218-0001/
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://ubuntu.com/security/notices/USN-5203-1
https://www.cve.org/CVERecord?id=CVE-2021-45105
https://www.debian.org/security/2021/dsa-5024
https://www.kb.cert.org/vuls/id/930724
https://www.openwall.com/lists/oss-security/2021/12/19/1
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-13934 | HIGH | 8.5.56 | 8.5.57, 9.0.37 |
Expand...http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html
http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3Cad62f54e-8fd7-e326-25f1-3bdf1ffa3818%40apache.org%3E
http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M7
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.105
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.57
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.37
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13934
https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html
https://nvd.nist.gov/vuln/detail/CVE-2020-13934
https://security.netapp.com/advisory/ntap-20200724-0003/
https://ubuntu.com/security/notices/USN-4596-1
https://usn.ubuntu.com/4596-1/
https://www.debian.org/security/2020/dsa-4727
https://www.openwall.com/lists/oss-security/2020/07/14/4
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2020-17527 | HIGH | 8.5.56 | 8.5.60, 9.0.40, 10.0.2 |
Expand...http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.0-M10
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60
http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40
http://www.openwall.com/lists/oss-security/2020/12/03/3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17527
https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b189eb29 (8.5.60)
https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db58c65 (9.0.40)
https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa@%3Ccommits.tomee.apache.org%3E
https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce@%3Cissues.guacamole.apache.org%3E
https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca@%3Cusers.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2020-17527
https://security.gentoo.org/glsa/202012-23
https://security.netapp.com/advisory/ntap-20201210-0003/
https://www.debian.org/security/2021/dsa-4835
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuApr2021.html
| | org.apache.tomcat.embed:tomcat-embed-core | CVE-2021-25122 | HIGH | 8.5.56 | 8.5.63, 9.0.43, 10.0.2 |
Expand...http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/03/01/1
https://github.com/advisories/GHSA-j39c-c8hj-x4j3
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cannounce.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947@%3Cusers.tomcat.apache.org%3E
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9@%3Cdev.tomcat.apache.org%3E
https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html
https://nvd.nist.gov/vuln/detail/CVE-2021-25122
https://security.netapp.com/advisory/ntap-20210409-0002/
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43
https://www.debian.org/security/2021/dsa-4891
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
| diff --git a/docs/apps/stable/unpackerr/CHANGELOG.md b/docs/apps/stable/unpackerr/CHANGELOG.md index 240a0171645..7337c9f1258 100644 --- a/docs/apps/stable/unpackerr/CHANGELOG.md +++ b/docs/apps/stable/unpackerr/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unpackerr-4.0.28](https://github.com/truecharts/apps/compare/unpackerr-4.0.27...unpackerr-4.0.28) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unpackerr-4.0.27](https://github.com/truecharts/apps/compare/unpackerr-4.0.26...unpackerr-4.0.27) (2021-12-19) diff --git a/docs/apps/stable/unpackerr/index.md b/docs/apps/stable/unpackerr/index.md index 94a5ac29321..cb217459721 100644 --- a/docs/apps/stable/unpackerr/index.md +++ b/docs/apps/stable/unpackerr/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/unpackerr/security.md b/docs/apps/stable/unpackerr/security.md index ae32938edd2..3964ecdb832 100644 --- a/docs/apps/stable/unpackerr/security.md +++ b/docs/apps/stable/unpackerr/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpackerr' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpackerr' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-unpackerr' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/unpoller/CHANGELOG.md b/docs/apps/stable/unpoller/CHANGELOG.md index e259e324e62..5e6fb9c48fb 100644 --- a/docs/apps/stable/unpoller/CHANGELOG.md +++ b/docs/apps/stable/unpoller/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [unpoller-1.0.18](https://github.com/truecharts/apps/compare/unpoller-1.0.17...unpoller-1.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [unpoller-1.0.17](https://github.com/truecharts/apps/compare/unpoller-1.0.16...unpoller-1.0.17) (2021-12-20) diff --git a/docs/apps/stable/unpoller/index.md b/docs/apps/stable/unpoller/index.md index 08c689ffb1f..5706a19d706 100644 --- a/docs/apps/stable/unpoller/index.md +++ b/docs/apps/stable/unpoller/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/unpoller/security.md b/docs/apps/stable/unpoller/security.md index f2da380fd47..477fbdce862 100644 --- a/docs/apps/stable/unpoller/security.md +++ b/docs/apps/stable/unpoller/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-unpoller' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-unpoller' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-unpoller' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/uptime-kuma/CHANGELOG.md b/docs/apps/stable/uptime-kuma/CHANGELOG.md index c59bf223e9f..335c126c503 100644 --- a/docs/apps/stable/uptime-kuma/CHANGELOG.md +++ b/docs/apps/stable/uptime-kuma/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [uptime-kuma-1.0.27](https://github.com/truecharts/apps/compare/uptime-kuma-1.0.26...uptime-kuma-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [uptime-kuma-1.0.26](https://github.com/truecharts/apps/compare/uptime-kuma-1.0.25...uptime-kuma-1.0.26) (2021-12-19) diff --git a/docs/apps/stable/uptime-kuma/index.md b/docs/apps/stable/uptime-kuma/index.md index a53cace4bd4..597feda9f31 100644 --- a/docs/apps/stable/uptime-kuma/index.md +++ b/docs/apps/stable/uptime-kuma/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/uptime-kuma/security.md b/docs/apps/stable/uptime-kuma/security.md index 6b655452724..bc4a216abd8 100644 --- a/docs/apps/stable/uptime-kuma/security.md +++ b/docs/apps/stable/uptime-kuma/security.md @@ -20,11 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptime-kuma' of Deployment 'RELEASE-NAME-uptime-kuma' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/uptimerobot-prometheus/CHANGELOG.md b/docs/apps/stable/uptimerobot-prometheus/CHANGELOG.md index 000a2aaf6bd..12caff65ec2 100644 --- a/docs/apps/stable/uptimerobot-prometheus/CHANGELOG.md +++ b/docs/apps/stable/uptimerobot-prometheus/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [uptimerobot-prometheus-2.0.7](https://github.com/truecharts/apps/compare/uptimerobot-prometheus-2.0.6...uptimerobot-prometheus-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [uptimerobot-prometheus-2.0.6](https://github.com/truecharts/apps/compare/uptimerobot-prometheus-2.0.5...uptimerobot-prometheus-2.0.6) (2021-12-19) diff --git a/docs/apps/stable/uptimerobot-prometheus/index.md b/docs/apps/stable/uptimerobot-prometheus/index.md index cf0c89e0efb..e221c76938b 100644 --- a/docs/apps/stable/uptimerobot-prometheus/index.md +++ b/docs/apps/stable/uptimerobot-prometheus/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/uptimerobot-prometheus/security.md b/docs/apps/stable/uptimerobot-prometheus/security.md index 25d4a6920e7..7eed8e4b5b3 100644 --- a/docs/apps/stable/uptimerobot-prometheus/security.md +++ b/docs/apps/stable/uptimerobot-prometheus/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-uptimerobot-prometheus' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-uptimerobot-prometheus' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/valheim/CHANGELOG.md b/docs/apps/stable/valheim/CHANGELOG.md index 40a4d37c2ed..3ddf7d9a96c 100644 --- a/docs/apps/stable/valheim/CHANGELOG.md +++ b/docs/apps/stable/valheim/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [valheim-2.0.7](https://github.com/truecharts/apps/compare/valheim-2.0.6...valheim-2.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [valheim-2.0.6](https://github.com/truecharts/apps/compare/valheim-2.0.5...valheim-2.0.6) (2021-12-19) diff --git a/docs/apps/stable/valheim/index.md b/docs/apps/stable/valheim/index.md index 3ce6cae154d..17c86e8a8c4 100644 --- a/docs/apps/stable/valheim/index.md +++ b/docs/apps/stable/valheim/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/valheim/security.md b/docs/apps/stable/valheim/security.md index 8c56c300d15..2c0610446a7 100644 --- a/docs/apps/stable/valheim/security.md +++ b/docs/apps/stable/valheim/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-valheim' of Deployment 'RELEASE-NAME-valheim' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -354,7 +350,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -373,7 +369,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -383,13 +379,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -436,7 +434,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | locales | CVE-2021-33574 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33574
https://linux.oracle.com/cve/CVE-2021-33574.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
https://security.gentoo.org/glsa/202107-07
https://security.netapp.com/advisory/ntap-20210629-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=27896
https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
| | locales | CVE-2021-35942 | CRITICAL | 2.28-10 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35942
https://linux.oracle.com/cve/CVE-2021-35942.html
https://linux.oracle.com/errata/ELSA-2021-9560.html
https://security.netapp.com/advisory/ntap-20210827-0005/
https://sourceware.org/bugzilla/show_bug.cgi?id=28011
https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
https://sourceware.org/glibc/wiki/Security%20Exceptions
| | locales | CVE-2020-1751 | HIGH | 2.28-10 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751
https://linux.oracle.com/cve/CVE-2020-1751.html
https://linux.oracle.com/errata/ELSA-2020-4444.html
https://security.gentoo.org/glsa/202006-04
https://security.netapp.com/advisory/ntap-20200430-0002/
https://sourceware.org/bugzilla/show_bug.cgi?id=25423
https://ubuntu.com/security/notices/USN-4416-1
https://usn.ubuntu.com/4416-1/
| diff --git a/docs/apps/stable/vaultwarden/CHANGELOG.md b/docs/apps/stable/vaultwarden/CHANGELOG.md index 3c60334ef94..89032fa940f 100644 --- a/docs/apps/stable/vaultwarden/CHANGELOG.md +++ b/docs/apps/stable/vaultwarden/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [vaultwarden-13.0.18](https://github.com/truecharts/apps/compare/vaultwarden-13.0.17...vaultwarden-13.0.18) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [vaultwarden-13.0.17](https://github.com/truecharts/apps/compare/vaultwarden-13.0.16...vaultwarden-13.0.17) (2021-12-19) diff --git a/docs/apps/stable/vaultwarden/index.md b/docs/apps/stable/vaultwarden/index.md index a216d617002..9b3595c4725 100644 --- a/docs/apps/stable/vaultwarden/index.md +++ b/docs/apps/stable/vaultwarden/index.md @@ -17,8 +17,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/vaultwarden/security.md b/docs/apps/stable/vaultwarden/security.md index bf526c178dc..e6ed3482087 100644 --- a/docs/apps/stable/vaultwarden/security.md +++ b/docs/apps/stable/vaultwarden/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -38,30 +34,25 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-vaultwarden' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-vaultwarden' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-vaultwarden' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/vaultwarden:v1.23.1@sha256:094eae865c2650b033313228359aafdef5f00008b8f44cb856ee418270cebdf9 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -98,7 +89,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -526,7 +517,7 @@ hide: | linux-libc-dev | CVE-2021-38300 | HIGH | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/09/15/5
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.10
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=37cb28ec7d3a36a5bace7063a3dba633ab110f8b
https://security.netapp.com/advisory/ntap-20211008-0003/
| | linux-libc-dev | CVE-2021-3864 | HIGH | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/20/2
| | linux-libc-dev | CVE-2021-4083 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083
https://git.kernel.org/linus/054aa8d439b9185d4f5eb9a90282d1ce74772969 (5.16-rc4)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
| -| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| +| linux-libc-dev | CVE-2021-41864 | HIGH | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41864
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a
https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a
https://linux.oracle.com/cve/CVE-2021-41864.html
https://linux.oracle.com/errata/ELSA-2021-9623.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LAT3RERO6QBKSPJBNNRWY3D4NCGTFOS7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYKURLXBB2555ASWMPDNMBUPD6AG2JKQ/
https://security.netapp.com/advisory/ntap-20211029-0004/
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5140-1
| | linux-libc-dev | CVE-2021-44733 | HIGH | 4.19.208-1 | |
Expand...https://lore.kernel.org/lkml/20211214123540.1789434-1-jens.wiklander@linaro.org/
| | linux-libc-dev | CVE-2019-15213 | MEDIUM | 4.19.208-1 | |
Expand...http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html
http://www.openwall.com/lists/oss-security/2019/08/20/2
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6cf97230cd5f36b7665099083272595c55d72be7
https://linux.oracle.com/cve/CVE-2019-15213.html
https://linux.oracle.com/errata/ELSA-2019-4872.html
https://lore.kernel.org/linux-media/fe983331d14442a96db3f71066ca0488a8921840.camel@decadent.org.uk/
https://security.netapp.com/advisory/ntap-20190905-0002/
https://syzkaller.appspot.com/bug?id=a53c9c9dd2981bfdbfbcbc1ddbd35595eda8bced
| | linux-libc-dev | CVE-2019-15794 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15794
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3
https://ubuntu.com/security/notices/USN-4208-1
https://ubuntu.com/security/notices/USN-4209-1
https://usn.ubuntu.com/usn/usn-4208-1
https://usn.ubuntu.com/usn/usn-4209-1
| @@ -545,7 +536,7 @@ hide: | linux-libc-dev | CVE-2020-36310 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=1769283#c148
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36310
https://git.kernel.org/linus/e72436bc3a5206f95bb384e741154166ddb3202e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e
https://linux.oracle.com/cve/CVE-2020-36310.html
https://linux.oracle.com/errata/ELSA-2021-9307.html
| | linux-libc-dev | CVE-2020-36322 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36322
https://git.kernel.org/linus/5d069dbe8aaf2a197142558b6fb2978189ba3454
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d069dbe8aaf2a197142558b6fb2978189ba3454
https://linux.oracle.com/cve/CVE-2020-36322.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://ubuntu.com/security/notices/USN-5136-1
| | linux-libc-dev | CVE-2021-20317 | MEDIUM | 4.19.208-1 | |
Expand...https://bugzilla.redhat.com/show_bug.cgi?id=2005258
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1
https://linux.oracle.com/cve/CVE-2021-20317.html
https://linux.oracle.com/errata/ELSA-2021-4647.html
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
| -| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20321
https://git.kernel.org/linus/a295aef603e109a47af355477326bd41151765b6 (5.15-rc5)
https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| +| linux-libc-dev | CVE-2021-20321 | MEDIUM | 4.19.208-1 | |
Expand...https://lore.kernel.org/all/20211011134508.748956131@linuxfoundation.org/
| | linux-libc-dev | CVE-2021-28950 | MEDIUM | 4.19.208-1 | |
Expand...https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28950
https://git.kernel.org/linus/775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=775c5033a0d164622d9d10dd0f0a5531639ed3ed
https://linux.oracle.com/cve/CVE-2021-28950.html
https://linux.oracle.com/errata/ELSA-2021-9488.html
https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FB6LUXPEIRLZH32YXWZVEZAD4ZL6SDK2/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRTPQE73ANG7D6M4L4PK5ZQDPO4Y2FVD/
https://ubuntu.com/security/notices/USN-4911-1
https://ubuntu.com/security/notices/USN-4982-1
https://ubuntu.com/security/notices/USN-4984-1
| | linux-libc-dev | CVE-2021-3640 | MEDIUM | 4.19.208-1 | |
Expand...https://lkml.org/lkml/2021/8/28/238
https://www.openwall.com/lists/oss-security/2021/07/22/1
| | linux-libc-dev | CVE-2021-3669 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3669
https://lore.kernel.org/all/20210809203554.1562989-1-aquini@redhat.com/
| @@ -555,13 +546,15 @@ hide: | linux-libc-dev | CVE-2021-3772 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3772
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=32f8807a48ae55be0e76880cfe8607a18b5bb0df
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-3847 | MEDIUM | 4.19.208-1 | |
Expand...https://www.openwall.com/lists/oss-security/2021/10/14/3
| | linux-libc-dev | CVE-2021-39685 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39685
https://github.com/szymonh/inspector-gadget
https://www.openwall.com/lists/oss-security/2021/12/15/4
| -| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4002
https://git.kernel.org/linus/a4a118f2eead1d6c49e00765de89878288d4b890
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| +| linux-libc-dev | CVE-2021-4002 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890
https://www.openwall.com/lists/oss-security/2021/11/25/1
| | linux-libc-dev | CVE-2021-4037 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=01ea173e103e
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848
| | linux-libc-dev | CVE-2021-4095 | MEDIUM | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-4135 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53
| | linux-libc-dev | CVE-2021-42739 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42739
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35d2969ea3c7d32aee78066b1f3cf61a0d935a4e
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EHZNHNHRLPC2NJKUDS5PJG5AGRYJVJN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AOWGMZ2MJFUGNA5QSD5JF4QHIC4URATS/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKMQEOEESIO3GMHAOL3NYS36FER6UTWA/
https://lore.kernel.org/linux-media/YHaulytonFcW+lyZ@mwanda/
https://seclists.org/oss-sec/2021/q2/46
https://security.netapp.com/advisory/ntap-20211118-0001/
https://ubuntu.com/security/notices/USN-5165-1
| | linux-libc-dev | CVE-2021-43389 | MEDIUM | 4.19.208-1 | |
Expand...http://www.openwall.com/lists/oss-security/2021/11/05/1
https://bugzilla.redhat.com/show_bug.cgi?id=2013180
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389
https://git.kernel.org/linus/1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d
https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html
https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/
https://seclists.org/oss-sec/2021/q4/39
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/19/1
| | linux-libc-dev | CVE-2021-43975 | MEDIUM | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43975
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=b922f622592af76b57cbc566eaeccda0b31a3496
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://lore.kernel.org/netdev/163698540868.13805.17800408021782408762.git-patchwork-notify@kernel.org/T/
https://security.netapp.com/advisory/ntap-20211210-0001/
| | linux-libc-dev | CVE-2021-43976 | MEDIUM | 4.19.208-1 | |
Expand...https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X24M7KDC4OJOZNS3RDSYC7ELNELOLQ2N/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YODMYMGZYDXQKGJGX7TJG4XV4L5YLLBD/
https://patchwork.kernel.org/project/linux-wireless/patch/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home/
https://security.netapp.com/advisory/ntap-20211210-0001/
| +| linux-libc-dev | CVE-2021-45095 | MEDIUM | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| | linux-libc-dev | CVE-2004-0230 | LOW | 4.19.208-1 | |
Expand...ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2004-006.txt.asc
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.3/SCOSA-2005.3.txt
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.9/SCOSA-2005.9.txt
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.14/SCOSA-2005.14.txt
ftp://patches.sgi.com/support/free/security/advisories/20040403-01-A.asc
http://kb.juniper.net/JSA10638
http://marc.info/?l=bugtraq&m=108302060014745&w=2
http://marc.info/?l=bugtraq&m=108506952116653&w=2
http://secunia.com/advisories/11440
http://secunia.com/advisories/11458
http://secunia.com/advisories/22341
http://www.cisco.com/warp/public/707/cisco-sa-20040420-tcp-ios.shtml
http://www.kb.cert.org/vuls/id/415294
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.osvdb.org/4030
http://www.securityfocus.com/archive/1/449179/100/0/threaded
http://www.securityfocus.com/bid/10183
http://www.uniras.gov.uk/vuls/2004/236929/index.htm
http://www.us-cert.gov/cas/techalerts/TA04-111A.html
http://www.vupen.com/english/advisories/2006/3983
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-019
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-064
https://exchange.xforce.ibmcloud.com/vulnerabilities/15886
https://kc.mcafee.com/corporate/index?page=content&id=SB10053
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2689
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A270
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5711
| | linux-libc-dev | CVE-2005-3660 | LOW | 4.19.208-1 | |
Expand...http://secunia.com/advisories/18205
http://securityreason.com/securityalert/291
http://securitytracker.com/id?1015402
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=362
http://www.securityfocus.com/bid/16041
http://www.vupen.com/english/advisories/2005/3076
https://exchange.xforce.ibmcloud.com/vulnerabilities/23835
| | linux-libc-dev | CVE-2007-3719 | LOW | 4.19.208-1 | |
Expand...http://osvdb.org/37127
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
| @@ -608,7 +601,11 @@ hide: | linux-libc-dev | CVE-2021-26934 | LOW | 4.19.208-1 | |
Expand...http://xenbits.xen.org/xsa/advisory-363.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26934
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GELN5E6MDR5KQBJF5M5COUUED3YFZTD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOAJBVAVR6RSCUCHNXPVSNRPSFM7INMP/
https://security.netapp.com/advisory/ntap-20210326-0001/
https://www.openwall.com/lists/oss-security/2021/02/16/2
https://xenbits.xen.org/xsa/advisory-363.html
| | linux-libc-dev | CVE-2021-32078 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32078
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=298a58e165e447ccfaae35fe9f651f9d7e15166f
https://git.kernel.org/linus/298a58e165e447ccfaae35fe9f651f9d7e15166f (5.13-rc1)
https://github.com/torvalds/linux/commit/298a58e165e447ccfaae35fe9f651f9d7e15166f
https://kirtikumarar.com/CVE-2021-32078.txt
https://security.netapp.com/advisory/ntap-20210813-0002/
| | linux-libc-dev | CVE-2021-3760 | LOW | 4.19.208-1 | |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3760
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1b1499a817c90fd1ce9453a2c98d2a01cca0e775
https://ubuntu.com/security/notices/USN-5139-1
https://ubuntu.com/security/notices/USN-5165-1
https://www.openwall.com/lists/oss-security/2021/10/26/2
| -| linux-libc-dev | CVE-2021-45095 | UNKNOWN | 4.19.208-1 | |
Expand...https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=bcd0f93353326954817a4f9fa55ec57fb38acbb0
https://github.com/torvalds/linux/commit/bcd0f93353326954817a4f9fa55ec57fb38acbb0
| +| linux-libc-dev | CVE-2021-28711 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28712 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28713 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28714 | UNKNOWN | 4.19.208-1 | |
Expand...
| +| linux-libc-dev | CVE-2021-28715 | UNKNOWN | 4.19.208-1 | |
Expand...
| | login | CVE-2007-5686 | LOW | 1:4.5-1.1 | |
Expand...http://secunia.com/advisories/27215
http://www.securityfocus.com/archive/1/482129/100/100/threaded
http://www.securityfocus.com/archive/1/482857/100/0/threaded
http://www.securityfocus.com/bid/26048
http://www.vupen.com/english/advisories/2007/3474
https://issues.rpath.com/browse/RPL-1825
| | login | CVE-2013-4235 | LOW | 1:4.5-1.1 | |
Expand...https://access.redhat.com/security/cve/cve-2013-4235
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4235
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://security-tracker.debian.org/tracker/CVE-2013-4235
| | login | CVE-2018-7169 | LOW | 1:4.5-1.1 | |
Expand...https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169
https://github.com/shadow-maint/shadow/pull/97
https://security.gentoo.org/glsa/201805-09
| @@ -663,7 +660,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/webgrabplus/CHANGELOG.md b/docs/apps/stable/webgrabplus/CHANGELOG.md index 6256d1fdddb..f8b3bf9d24a 100644 --- a/docs/apps/stable/webgrabplus/CHANGELOG.md +++ b/docs/apps/stable/webgrabplus/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [webgrabplus-0.0.8](https://github.com/truecharts/apps/compare/webgrabplus-0.0.7...webgrabplus-0.0.8) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [webgrabplus-0.0.7](https://github.com/truecharts/apps/compare/webgrabplus-0.0.6...webgrabplus-0.0.7) (2021-12-19) diff --git a/docs/apps/stable/webgrabplus/index.md b/docs/apps/stable/webgrabplus/index.md index dd0b5644a3a..653e2b40a74 100644 --- a/docs/apps/stable/webgrabplus/index.md +++ b/docs/apps/stable/webgrabplus/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/webgrabplus/security.md b/docs/apps/stable/webgrabplus/security.md index 1a531f2bac4..3814df178ab 100644 --- a/docs/apps/stable/webgrabplus/security.md +++ b/docs/apps/stable/webgrabplus/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-webgrabplus' of Deployment 'RELEASE-NAME-webgrabplus' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/whoogle/CHANGELOG.md b/docs/apps/stable/whoogle/CHANGELOG.md index 2ed26384612..ea5efa55963 100644 --- a/docs/apps/stable/whoogle/CHANGELOG.md +++ b/docs/apps/stable/whoogle/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [whoogle-1.0.27](https://github.com/truecharts/apps/compare/whoogle-1.0.26...whoogle-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [whoogle-1.0.26](https://github.com/truecharts/apps/compare/whoogle-1.0.25...whoogle-1.0.26) (2021-12-20) diff --git a/docs/apps/stable/whoogle/index.md b/docs/apps/stable/whoogle/index.md index d524c472efa..387dbe7619e 100644 --- a/docs/apps/stable/whoogle/index.md +++ b/docs/apps/stable/whoogle/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/whoogle/security.md b/docs/apps/stable/whoogle/security.md index bce45ad1286..a7e34276a0c 100644 --- a/docs/apps/stable/whoogle/security.md +++ b/docs/apps/stable/whoogle/security.md @@ -20,12 +20,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-whoogle' of Deployment 'RELEASE-NAME-whoogle' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/wikijs/CHANGELOG.md b/docs/apps/stable/wikijs/CHANGELOG.md index d98aafb1204..74abf3a542c 100644 --- a/docs/apps/stable/wikijs/CHANGELOG.md +++ b/docs/apps/stable/wikijs/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [wikijs-4.0.17](https://github.com/truecharts/apps/compare/wikijs-4.0.16...wikijs-4.0.17) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [wikijs-4.0.16](https://github.com/truecharts/apps/compare/wikijs-4.0.15...wikijs-4.0.16) (2021-12-20) diff --git a/docs/apps/stable/wikijs/index.md b/docs/apps/stable/wikijs/index.md index 5331ebc6cce..efca9ec917d 100644 --- a/docs/apps/stable/wikijs/index.md +++ b/docs/apps/stable/wikijs/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | postgresql | 6.0.34 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | postgresql | 6.0.37 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/wikijs/security.md b/docs/apps/stable/wikijs/security.md index f5ea2ef4a2d..230621dfa77 100644 --- a/docs/apps/stable/wikijs/security.md +++ b/docs/apps/stable/wikijs/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-postgresql' of StatefulSet 'RELEASE-NAME-postgresql' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -39,15 +35,9 @@ hide: | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wikijs' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'postgresql-init' of Deployment 'RELEASE-NAME-wikijs' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| @@ -61,10 +51,10 @@ hide: ##### Detected Containers tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 tccr.io/truecharts/wikijs:v2.5.260@sha256:49e014e4774c5cbbbcc9327f437224b748547859ca540211e63051ed60461c5b tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 + tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 ##### Scan Results @@ -101,7 +91,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** @@ -388,7 +378,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:7ad9b2cbcb614f0c2409c401804da15ccf82e7072acffa0b6aca1dcbf72a6018 (debian 10.11) +#### Container: tccr.io/truecharts/postgresql:v14.1.0@sha256:bb32d5eedec5f729ff1618cecf3291dc3588a5da6ba5321d9dd88873d92b0832 (debian 10.11) **debian** diff --git a/docs/apps/stable/wireshark/CHANGELOG.md b/docs/apps/stable/wireshark/CHANGELOG.md index 505856926cd..042b7095612 100644 --- a/docs/apps/stable/wireshark/CHANGELOG.md +++ b/docs/apps/stable/wireshark/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [wireshark-0.0.7](https://github.com/truecharts/apps/compare/wireshark-0.0.6...wireshark-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [wireshark-0.0.6](https://github.com/truecharts/apps/compare/wireshark-0.0.5...wireshark-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/wireshark/index.md b/docs/apps/stable/wireshark/index.md index 44bd0d850e1..67018162362 100644 --- a/docs/apps/stable/wireshark/index.md +++ b/docs/apps/stable/wireshark/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/wireshark/security.md b/docs/apps/stable/wireshark/security.md index d0f20e8fa9b..ddd1345b5d4 100644 --- a/docs/apps/stable/wireshark/security.md +++ b/docs/apps/stable/wireshark/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-wireshark' of Deployment 'RELEASE-NAME-wireshark' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -392,3 +389,4 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| | github.com/containerd/containerd | CVE-2021-41103 | HIGH | v1.5.4 | v1.4.11, v1.5.7 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103
https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8
https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41103
https://ubuntu.com/security/notices/USN-5100-1
https://www.debian.org/security/2021/dsa-5002
| | github.com/docker/cli | CVE-2021-41092 | HIGH | v20.10.3-0.20210702143511-f782d1355eff+incompatible | v20.10.9 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41092
https://github.com/docker/cli/commit/893e52cf4ba4b048d72e99748e0f86b2767c6c6b
https://github.com/docker/cli/security/advisories/GHSA-99pg-grm5-qq3v
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/
https://nvd.nist.gov/vuln/detail/CVE-2021-41092
https://ubuntu.com/security/notices/USN-5134-1
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.4 | 0.3.7 |
Expand...
| diff --git a/docs/apps/stable/xbackbone/CHANGELOG.md b/docs/apps/stable/xbackbone/CHANGELOG.md index d0d17a2f5ce..9c66cc4f8e4 100644 --- a/docs/apps/stable/xbackbone/CHANGELOG.md +++ b/docs/apps/stable/xbackbone/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [xbackbone-0.0.15](https://github.com/truecharts/apps/compare/xbackbone-0.0.14...xbackbone-0.0.15) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [xbackbone-0.0.14](https://github.com/truecharts/apps/compare/xbackbone-0.0.13...xbackbone-0.0.14) (2021-12-19) diff --git a/docs/apps/stable/xbackbone/index.md b/docs/apps/stable/xbackbone/index.md index e8448d64ce3..5cdfb986426 100644 --- a/docs/apps/stable/xbackbone/index.md +++ b/docs/apps/stable/xbackbone/index.md @@ -18,8 +18,8 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org/ | mariadb | 1.0.37 | -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org/ | mariadb | 1.0.40 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/xbackbone/security.md b/docs/apps/stable/xbackbone/security.md index 438ee453ae5..95f90bc1b83 100644 --- a/docs/apps/stable/xbackbone/security.md +++ b/docs/apps/stable/xbackbone/security.md @@ -19,12 +19,8 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-mariadb' of StatefulSet 'RELEASE-NAME-mariadb' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -37,12 +33,8 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xbackbone' of Deployment 'RELEASE-NAME-xbackbone' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| @@ -56,7 +48,7 @@ hide: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c tccr.io/truecharts/xbackbone:v3.3.3@sha256:c22e8806732b5a63a9761d413f4dd3a39af9427a12818e8ff769094ebc141c99 tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c - tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 + tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 ##### Scan Results @@ -499,7 +491,7 @@ hide: | ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
| -#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:e40182491d06886b5bdd7eb5dda04b5eace4f589a5042ecaf0002901dab2f0a5 (debian 10.11) +#### Container: tccr.io/truecharts/mariadb:v10.6.5@sha256:405f349cb6348b221f2253ee856f8643a757d7fc2d26508289b86030d7c67fa5 (debian 10.11) **debian** diff --git a/docs/apps/stable/xteve/CHANGELOG.md b/docs/apps/stable/xteve/CHANGELOG.md index ca86eeee9c9..7a873308232 100644 --- a/docs/apps/stable/xteve/CHANGELOG.md +++ b/docs/apps/stable/xteve/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [xteve-4.0.26](https://github.com/truecharts/apps/compare/xteve-4.0.25...xteve-4.0.26) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [xteve-4.0.25](https://github.com/truecharts/apps/compare/xteve-4.0.24...xteve-4.0.25) (2021-12-19) diff --git a/docs/apps/stable/xteve/index.md b/docs/apps/stable/xteve/index.md index ac28ae96d10..51a70450fe9 100644 --- a/docs/apps/stable/xteve/index.md +++ b/docs/apps/stable/xteve/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/xteve/security.md b/docs/apps/stable/xteve/security.md index b1a18ab3ffe..c70a12079ce 100644 --- a/docs/apps/stable/xteve/security.md +++ b/docs/apps/stable/xteve/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-xteve' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-xteve' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-xteve' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers @@ -781,4 +778,6 @@ hide: | Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | |:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| -| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | v2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| +| golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14040
https://github.com/golang/go/issues/39491
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
https://linux.oracle.com/cve/CVE-2020-14040.html
https://linux.oracle.com/errata/ELSA-2020-4694.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/
https://nvd.nist.gov/vuln/detail/CVE-2020-14040
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.2 | 0.3.7 |
Expand...
| +| gopkg.in/yaml.v2 | CVE-2019-11254 | MEDIUM | v2.2.7 | 2.2.8 |
Expand...https://github.com/kubernetes/kubernetes/issues/89535
https://groups.google.com/d/msg/kubernetes-announce/ALL9s73E5ck/4yHe8J-PBAAJ
https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc
https://linux.oracle.com/cve/CVE-2019-11254.html
https://linux.oracle.com/errata/ELSA-2020-5653.html
https://security.netapp.com/advisory/ntap-20200413-0003/
| diff --git a/docs/apps/stable/zigbee2mqtt/CHANGELOG.md b/docs/apps/stable/zigbee2mqtt/CHANGELOG.md index cc0ff3a97d9..86ff9c43a92 100644 --- a/docs/apps/stable/zigbee2mqtt/CHANGELOG.md +++ b/docs/apps/stable/zigbee2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [zigbee2mqtt-1.0.27](https://github.com/truecharts/apps/compare/zigbee2mqtt-1.0.26...zigbee2mqtt-1.0.27) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [zigbee2mqtt-1.0.26](https://github.com/truecharts/apps/compare/zigbee2mqtt-1.0.25...zigbee2mqtt-1.0.26) (2021-12-19) diff --git a/docs/apps/stable/zigbee2mqtt/index.md b/docs/apps/stable/zigbee2mqtt/index.md index 555a1188ce6..da5f052400a 100644 --- a/docs/apps/stable/zigbee2mqtt/index.md +++ b/docs/apps/stable/zigbee2mqtt/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/zigbee2mqtt/security.md b/docs/apps/stable/zigbee2mqtt/security.md index 093ba44f302..011da8037af 100644 --- a/docs/apps/stable/zigbee2mqtt/security.md +++ b/docs/apps/stable/zigbee2mqtt/security.md @@ -19,15 +19,12 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zigbee2mqtt' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-zigbee2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/apps/stable/znc/CHANGELOG.md b/docs/apps/stable/znc/CHANGELOG.md index 8f1726f14a2..ac517550530 100644 --- a/docs/apps/stable/znc/CHANGELOG.md +++ b/docs/apps/stable/znc/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [znc-0.0.7](https://github.com/truecharts/apps/compare/znc-0.0.6...znc-0.0.7) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [znc-0.0.6](https://github.com/truecharts/apps/compare/znc-0.0.5...znc-0.0.6) (2021-12-19) diff --git a/docs/apps/stable/znc/index.md b/docs/apps/stable/znc/index.md index 918da426712..e7391905816 100644 --- a/docs/apps/stable/znc/index.md +++ b/docs/apps/stable/znc/index.md @@ -17,7 +17,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/znc/security.md b/docs/apps/stable/znc/security.md index dfdff83c935..c5188382998 100644 --- a/docs/apps/stable/znc/security.md +++ b/docs/apps/stable/znc/security.md @@ -20,10 +20,7 @@ hide: | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-znc' of Deployment 'RELEASE-NAME-znc' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| diff --git a/docs/apps/stable/zwavejs2mqtt/CHANGELOG.md b/docs/apps/stable/zwavejs2mqtt/CHANGELOG.md index a6d393d09a2..eb3a2aa22e8 100644 --- a/docs/apps/stable/zwavejs2mqtt/CHANGELOG.md +++ b/docs/apps/stable/zwavejs2mqtt/CHANGELOG.md @@ -1,6 +1,15 @@ # Changelog
+ +### [zwavejs2mqtt-9.0.33](https://github.com/truecharts/apps/compare/zwavejs2mqtt-9.0.32...zwavejs2mqtt-9.0.33) (2021-12-21) + +#### Chore + +* update helm general non-major helm releases ([#1596](https://github.com/truecharts/apps/issues/1596)) + + + ### [zwavejs2mqtt-9.0.32](https://github.com/truecharts/apps/compare/zwavejs2mqtt-9.0.31...zwavejs2mqtt-9.0.32) (2021-12-20) diff --git a/docs/apps/stable/zwavejs2mqtt/index.md b/docs/apps/stable/zwavejs2mqtt/index.md index 84a60c8b503..e5752139a06 100644 --- a/docs/apps/stable/zwavejs2mqtt/index.md +++ b/docs/apps/stable/zwavejs2mqtt/index.md @@ -18,7 +18,7 @@ Kubernetes: `>=1.16.0-0` | Repository | Name | Version | |------------|------|---------| -| https://truecharts.org | common | 8.9.24 | +| https://truecharts.org | common | 8.9.25 | ## Installing the Chart diff --git a/docs/apps/stable/zwavejs2mqtt/security.md b/docs/apps/stable/zwavejs2mqtt/security.md index ba45ef7afeb..3b7773321b9 100644 --- a/docs/apps/stable/zwavejs2mqtt/security.md +++ b/docs/apps/stable/zwavejs2mqtt/security.md @@ -19,16 +19,13 @@ hide: |:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| | Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| | Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| -| Kubernetes Security Check | KSV013 | Image tag ':latest' used | LOW |
Expand... It is best to avoid using the ':latest' image tag when deploying containers in production. Doing so makes it hard to track which version of the image is running, and hard to roll back the version.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify an image tag
|
Expand...https://kubernetes.io/docs/concepts/configuration/overview/#container-images
https://avd.aquasec.com/appshield/ksv013
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| | Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| -| Kubernetes Security Check | KSV019 | Seccomp policies disabled | MEDIUM |
Expand... A program inside the container can bypass Seccomp protection policies.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should specify a seccomp profile
|
Expand...https://kubesec.io/basics/metadata-annotations-container-seccomp-security-alpha-kubernetes-io-pod/
https://avd.aquasec.com/appshield/ksv019
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-zwavejs2mqtt' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| | Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-zwavejs2mqtt' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| ## Containers diff --git a/docs/index.yaml b/docs/index.yaml index 4ef77677b61..6638b573118 100644 --- a/docs/index.yaml +++ b/docs/index.yaml @@ -1,6 +1,37 @@ apiVersion: v1 entries: airsonic: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 10.6.2 + created: "2021-12-21T18:45:47.184794221Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Airsonic is a Free and Open Source community driven media server + digest: 4ab660924278fb06ef68f697d706725609f9c40d6d4f8e62c768ce2b2cde3e91 + home: https://github.com/truecharts/apps/tree/master/charts/stable/airsonic + icon: https://truecharts.org/_static/img/appicons/airsonic-icon.png + keywords: + - airsonic + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: airsonic + sources: + - https://github.com/airsonic/airsonic + - https://github.com/linuxserver/docker-airsonic + - https://github.com/k8s-at-home/charts/tree/master/charts/airsonic + urls: + - https://github.com/truecharts/apps/releases/download/airsonic-4.0.28/airsonic-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -95,6 +126,35 @@ entries: - https://github.com/truecharts/apps/releases/download/airsonic-4.0.23/airsonic-4.0.23.tgz version: 4.0.23 amcrest2mqtt: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.11 + created: "2021-12-21T18:45:47.336834916Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Expose all events from an Amcrest device to an MQTT broker + digest: 5057abffdc0358d448dba9814845836d5240b8e32b11a78515b2046f8e4d69d1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/amcrest2mqtt + icon: https://truecharts.org/_static/img/appicons/amcrest2mqtt-icon.png + keywords: + - amcrest2mqtt + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: amcrest2mqtt + sources: + - https://github.com/dchesterton/amcrest2mqtt + urls: + - https://github.com/truecharts/apps/releases/download/amcrest2mqtt-2.0.28/amcrest2mqtt-2.0.28.tgz + version: 2.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -183,6 +243,43 @@ entries: - https://github.com/truecharts/apps/releases/download/amcrest2mqtt-2.0.23/amcrest2mqtt-2.0.23.tgz version: 2.0.23 anonaddy: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - email + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.8.9 + created: "2021-12-21T18:45:47.544429704Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: Protect your email from spam using disposable addresses. + digest: f5f23aa5e93e56ab41c25617b74432246c99fb0f6326dca0e11eac3c8c6192c7 + home: https://github.com/truechartsapps/tree/master/charts/stable/anonaddy + icon: https://truecharts.org/_static/img/appicons/anonaddy-icon.png + keywords: + - anonaddy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: anonaddy + sources: + - https://github.com/anonaddy/docker + urls: + - https://github.com/truecharts/apps/releases/download/anonaddy-6.0.18/anonaddy-6.0.18.tgz + version: 6.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -369,6 +466,38 @@ entries: - https://github.com/truecharts/apps/releases/download/anonaddy-6.0.9/anonaddy-6.0.9.tgz version: 6.0.9 apache-musicindex: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.4.1 + created: "2021-12-21T18:45:47.704565023Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Index and stream music using apache-musicindex and m3u playlists + digest: 7d8b51f64f59df3d3d915f80b6e4a5f65e511e352f5d8ce976868990aef0bfd6 + home: https://github.com/truecharts/apps/tree/master/charts/stable/apache-musicindex + icon: https://truecharts.org/_static/img/appicons/apache-musicindex-icon.png + keywords: + - apache-musicindex + - streaming + - m3u + - playlist + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: apache-musicindex + sources: + - http://hacks.slashdirt.org/sw/musicindex/ + urls: + - https://github.com/truecharts/apps/releases/download/apache-musicindex-2.0.26/apache-musicindex-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -466,6 +595,43 @@ entries: - https://github.com/truecharts/apps/releases/download/apache-musicindex-2.0.21/apache-musicindex-2.0.21.tgz version: 2.0.21 appdaemon: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - utilities + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.1.0 + created: "2021-12-21T18:45:47.873226857Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: AppDaemon is a loosely coupled, multithreaded, sandboxed python execution + environment for writing automation apps for Home Assistant home automation software. + It also provides a configurable dashboard (HADashboard) suitable for wall mounted + tablets. + digest: 85918114d9977e9682d22de1cf6bd35df4f9132d369c90abe97e91eea2146cc2 + home: https://github.com/truecharts/apps/tree/master/charts/stable/appdaemon + icon: https://truecharts.org/_static/img/appicons/appdaemon-icon.png + keywords: + - appdaemon + - homeautomation + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + - email: 20650065+warllo54@users.noreply.github.com + name: warllo54 + url: truecharts.org + name: appdaemon + sources: + - https://github.com/AppDaemon/appdaemon + type: application + urls: + - https://github.com/truecharts/apps/releases/download/appdaemon-7.0.7/appdaemon-7.0.7.tgz + version: 7.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -615,6 +781,35 @@ entries: - https://github.com/truecharts/apps/releases/download/appdaemon-7.0.0/appdaemon-7.0.0.tgz version: 7.0.0 aria2: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:45:48.051209888Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: aria server for downloading web content + digest: cfdf0dc4b4d33429b5ffb7be20f75374d893995dda9d437e68aa800077cd9bde + home: https://github.com/truecharts/apps/tree/master/charts/stable/aira2 + icon: https://truecharts.org/_static/img/appicons/aria2-icon.png + keywords: + - aria2 + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: aria2 + sources: + - https://github.com/P3TERX/Aria2-Pro-Docker + urls: + - https://github.com/truecharts/apps/releases/download/aria2-3.0.7/aria2-3.0.7.tgz + version: 3.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -732,6 +927,41 @@ entries: - https://github.com/truecharts/apps/releases/download/aria2-3.0.0/aria2-3.0.0.tgz version: 3.0.0 audacity: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.0.2 + created: "2021-12-21T18:45:48.216225701Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An easy-to-use, multi-track audio editor and recorder + digest: c9eaed0a9a2ab66fc1bc75b06f8a2593be8883d316dcb445d2287ebca9dceed5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/audacity + icon: https://truecharts.org/_static/img/appicons/audacity-icon.png + keywords: + - audacity + - music + - recorder + - editor + - audio + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: audacity + sources: + - https://github.com/linuxserver/docker-audacity + - https://www.audacityteam.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/audacity-2.0.26/audacity-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -838,6 +1068,55 @@ entries: - https://github.com/truecharts/apps/releases/download/audacity-2.0.21/audacity-2.0.21.tgz version: 2.0.21 authelia: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - security + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.33.1 + created: "2021-12-21T18:45:48.436670409Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + - condition: redis.enabled + name: redis + repository: https://truecharts.org/ + version: 1.0.42 + description: Authelia is a Single Sign-On Multi-Factor portal for web apps + digest: e5170c88c996681bfc1af610664d928a5520cdd409169e8e7f62278fd555611d + home: https://github.com/truecharts/apps/tree/master/charts/stable/authelia + icon: https://truecharts.org/_static/img/appicons/authelia-icon.png + keywords: + - authelia + - authentication + - login + - SSO + - Authentication + - Security + - Two-Factor + - U2F + - YubiKey + - Push Notifications + - LDAP + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: authelia + sources: + - https://github.com/authelia/chartrepo + - https://github.com/authelia/authelia + type: application + urls: + - https://github.com/truecharts/apps/releases/download/authelia-8.0.21/authelia-8.0.21.tgz + version: 8.0.21 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1035,6 +1314,46 @@ entries: - https://github.com/truecharts/apps/releases/download/authelia-8.0.13/authelia-8.0.13.tgz version: 8.0.13 babybuddy: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.9.3 + created: "2021-12-21T18:45:48.616227606Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Helps caregivers track sleep, feedings, diaper changes, tummy time + and more to learn about and predict baby's needs without (as much) guess work. + digest: d45689afbf704b97a86be12a872a562d5527f8fbf97c502de63774734c2601a8 + home: https://github.com/truecharts/apps/tree/main/charts/babybuddy + icon: https://truecharts.org/_static/img/appicons/babybuddy-icon.png + keywords: + - baby + - buddy + - tracker + - parents + - parenting + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: babybuddy + sources: + - https://github.com/babybuddy/babybuddy + - https://github.com/nicholaswilde/docker-babybuddy + type: application + urls: + - https://github.com/truecharts/apps/releases/download/babybuddy-5.0.23/babybuddy-5.0.23.tgz + version: 5.0.23 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1196,6 +1515,43 @@ entries: - https://github.com/truecharts/apps/releases/download/babybuddy-5.0.16/babybuddy-5.0.16.tgz version: 5.0.16 bazarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.1 + created: "2021-12-21T18:45:48.783198277Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Bazarr is a companion application to Sonarr and Radarr. It manages + and downloads subtitles based on your requirements + digest: cbfad6d7486505bc1fc605067e7b88eeaf60e036f2e0ba0fa18cfd75c96fc46a + home: https://github.com/truecharts/apps/tree/master/charts/stable/bazarr + icon: https://truecharts.org/_static/img/appicons/bazarr-icon.png + keywords: + - bazarr + - radarr + - sonarr + - subtitles + - usenet + - torrent + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: bazarr + sources: + - https://github.com/morpheus65535/bazarr + - https://hub.docker.com/r/linuxserver/bazarr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/bazarr-9.0.29/bazarr-9.0.29.tgz + version: 9.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1345,6 +1701,41 @@ entries: - https://github.com/truecharts/apps/releases/download/bazarr-9.0.23/bazarr-9.0.23.tgz version: 9.0.23 beets: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.5.0 + created: "2021-12-21T18:45:48.948301588Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A music library manager and not, for the most part, a music player. + digest: 458fbfe6623cbd6e9f26072adaf98101faac43d9a7befac8ee114e2268ae1c14 + home: https://github.com/truecharts/apps/tree/master/charts/stable/beets + icon: https://truecharts.org/_static/img/appicons/beets-icon.png + keywords: + - music + - library + - manager + - player + - beets + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: beets + sources: + - https://github.com/linuxserver/docker-beets + - https://beets.io/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/beets-2.0.29/beets-2.0.29.tgz + version: 2.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1486,6 +1877,44 @@ entries: - https://github.com/truecharts/apps/releases/download/beets-2.0.23/beets-2.0.23.tgz version: 2.0.23 blog: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - hosting + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:45:49.130012938Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Lightweight self-hosted facebook-styled PHP blog. + digest: fd27edf38a7082e04ce6263d7489ef219552054c5503372c8ce9108ca22f5164 + home: https://github.com/truechartsapps/tree/master/charts/stable/blog + icon: https://truecharts.org/_static/img/appicons/blog-icon.png + keywords: + - blog + - php + - self + - hosted + - facebook + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: blog + sources: + - https://github.com/m1k1o/blog + - https://github.com/nicholaswilde/docker-blog + urls: + - https://github.com/truecharts/apps/releases/download/blog-0.0.16/blog-0.0.16.tgz + version: 0.0.16 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1639,6 +2068,37 @@ entries: - https://github.com/truecharts/apps/releases/download/blog-0.0.10/blog-0.0.10.tgz version: 0.0.10 boinc: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 18.04.1 + created: "2021-12-21T18:45:49.291957218Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: BOINC is a platform for high-throughput computing on a large scale + (thousands or millions of computers). + digest: 274f3837579ce2aadbadaa555891b22f8aee454ee9ea8c93452f5615de3b21cf + home: https://github.com/truecharts/apps/tree/master/charts/stable/boinc + icon: https://truecharts.org/_static/img/appicons/boinc-icon.png + keywords: + - boinc + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: boinc + sources: + - https://hub.docker.com/r/linuxserver/boinc + type: application + urls: + - https://github.com/truecharts/apps/releases/download/boinc-0.0.7/boinc-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1764,6 +2224,38 @@ entries: - https://github.com/truecharts/apps/releases/download/boinc-0.0.1/boinc-0.0.1.tgz version: 0.0.1 booksonic-air: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2009.1.0 + created: "2021-12-21T18:45:49.482391079Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Booksonic is a platform for accessing the audibooks you own wherever + you are + digest: e976cad1eb1e3e9388171e9140fdae720b2d12cfcc1844f1bb377ede6cbc3ba8 + home: https://github.com/truechartsapps/tree/master/charts/stable/booksonic-air + icon: https://truecharts.org/_static/img/appicons/booksonic-air-icon.png + keywords: + - booksonic + - audiobook + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: booksonic-air + sources: + - https://github.com/popeen/Booksonic-Air + - https://hub.docker.com/r/linuxserver/booksonic-air + urls: + - https://github.com/truecharts/apps/releases/download/booksonic-air-4.0.28/booksonic-air-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -1893,6 +2385,46 @@ entries: - https://github.com/truecharts/apps/releases/download/booksonic-air-4.0.20/booksonic-air-4.0.20.tgz version: 4.0.20 bookstack: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 21.11.2021 + created: "2021-12-21T18:45:49.6746403Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: A simple, self-hosted, easy-to-use platform for organising and storing + information. + digest: 6eb0631256daa98c5d65dd41b080d166fe04b900b041daebbaa6b41369e6c2dc + home: https://github.com/truechartsapps/tree/master/charts/stable/bookstack + icon: https://truecharts.org/_static/img/appicons/bookstack-icon.png + keywords: + - bookstack + - book + - stack + - organizer + - server + - hosted + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: bookstack + sources: + - https://www.bookstackapp.com/ + - https://hub.docker.com/r/linuxserver/bookstack + urls: + - https://github.com/truecharts/apps/releases/download/bookstack-0.0.16/bookstack-0.0.16.tgz + version: 0.0.16 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2014,6 +2546,36 @@ entries: - https://github.com/truecharts/apps/releases/download/bookstack-0.0.11/bookstack-0.0.11.tgz version: 0.0.11 calibre: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.32.0 + created: "2021-12-21T18:45:49.83887803Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Calibre is a powerful and easy to use e-book manager. + digest: b868a71f020f541f3e92db17073794659ba227571cec9b2f753e509a7ee192fb + home: https://github.com/truechartsapps/tree/master/charts/stable/calibre + icon: https://truecharts.org/_static/img/appicons/calibre-icon.png + keywords: + - calibre + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: calibre + sources: + - https://hub.docker.com/r/linuxserver/calibre/ + - https://github.com/kovidgoyal/calibre/ + urls: + - https://github.com/truecharts/apps/releases/download/calibre-5.0.7/calibre-5.0.7.tgz + version: 5.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2135,6 +2697,40 @@ entries: - https://github.com/truecharts/apps/releases/download/calibre-5.0.0/calibre-5.0.0.tgz version: 5.0.0 calibre-web: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.6.12 + created: "2021-12-21T18:45:49.993933659Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Calibre-Web is a web app providing a clean interface for browsing, + reading and downloading eBooks using an existing Calibre database. + digest: a6502f9e66d56d6ce8b7a205dd6348d84ecdf48899f47e11e59c357d5834a31d + home: https://github.com/truecharts/apps/tree/master/charts/stable/calibre-web + icon: https://truecharts.org/_static/img/appicons/calibre-web-icon.png + keywords: + - calibre-web + - calibre + - ebook + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: calibre-web + sources: + - https://hub.docker.com/r/linuxserver/calibre-web/ + - https://github.com/janeczku/calibre-web + type: application + urls: + - https://github.com/truecharts/apps/releases/download/calibre-web-9.0.26/calibre-web-9.0.26.tgz + version: 9.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2238,6 +2834,41 @@ entries: - https://github.com/truecharts/apps/releases/download/calibre-web-9.0.21/calibre-web-9.0.21.tgz version: 9.0.21 chevereto: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.6.0 + created: "2021-12-21T18:45:50.157329408Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: Chevereto is an image hosting software that allows you to create + a beautiful and full-featured image hosting website on your own server. + digest: e8e27f3613462efabc961f4fddfed968cab812437e5ef4ee35348816204671c8 + home: https://github.com/truecharts/apps/tree/master/charts/stable/chevereto + icon: https://truecharts.org/_static/img/appicons/chevereto-icon.png + keywords: + - chevereto + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: chevereto + sources: + - https://hub.docker.com/r/linuxserver/chevereto + type: application + urls: + - https://github.com/truecharts/apps/releases/download/chevereto-0.0.8/chevereto-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2414,6 +3045,45 @@ entries: - https://github.com/truecharts/apps/releases/download/chevereto-0.0.1/chevereto-0.0.1.tgz version: 0.0.1 clarkson: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - vehicle + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.1.2 + created: "2021-12-21T18:45:50.355899091Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: A web-based dashboard application that gives you a neat and clean + interface for logging your fuel fill-ups for all of your vehicles. + digest: ba77e85c581ae5b9a4edb222d7bebdbb001bdd2727416a8b58706966831eeb7d + home: https://github.com/truechartsapps/tree/master/charts/stable/clarkson + icon: https://truecharts.org/_static/img/appicons/clarkson-icon.png + keywords: + - fuel + - car + - log + - fill-up + - vehicle + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: clarkson + sources: + - https://github.com/linuxserver/Clarkson + - https://hub.docker.com/r/linuxserver/clarkson + urls: + - https://github.com/truecharts/apps/releases/download/clarkson-0.0.17/clarkson-0.0.17.tgz + version: 0.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2571,6 +3241,41 @@ entries: - https://github.com/truecharts/apps/releases/download/clarkson-0.0.9/clarkson-0.0.9.tgz version: 0.0.9 cloud9: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.29.2 + created: "2021-12-21T18:45:50.509959943Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A complete web based IDE with terminal access + digest: 6c4216bd1728ff496b98de45fa86d0c92e9afa9c235c32fa30fbbdda0bc2cce2 + home: https://github.com/truecharts/apps/tree/master/charts/stable/cloud9 + icon: https://truecharts.org/_static/img/appicons/cloud9-icon.png + keywords: + - cloud9 + - ide + - terminal + - web + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: cloud9 + sources: + - https://aws.amazon.com/cloud9/ + - https://github.com/c9/core + - https://hub.docker.com/r/linuxserver/cloud9 + type: application + urls: + - https://github.com/truecharts/apps/releases/download/cloud9-2.0.29/cloud9-2.0.29.tgz + version: 2.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2677,6 +3382,39 @@ entries: - https://github.com/truecharts/apps/releases/download/cloud9-2.0.24/cloud9-2.0.24.tgz version: 2.0.24 code-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.12.0 + created: "2021-12-21T18:45:50.666919131Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Run VS Code on any machine anywhere and access it in the browser. + digest: eb4dc0117523a96f8d2d7c140a8b3c88799bafdb4bd319b7dc47a12a6dc0a13f + home: https://github.com/truecharts/apps/tree/master/charts/stable/code-server + icon: https://truecharts.org/_static/img/appicons/code-server-icon.png + keywords: + - code + - vs + - visual studio + - vscode + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: code-server + sources: + - https://github.com/cdr/code-server + type: application + urls: + - https://github.com/truecharts/apps/releases/download/code-server-2.1.9/code-server-2.1.9.tgz + version: 2.1.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -2909,6 +3647,41 @@ entries: - https://github.com/truecharts/apps/releases/download/code-server-2.0.19/code-server-2.0.19.tgz version: 2.0.19 collabora-online: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - office + - documents + - productivity + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.4.14.3 + created: "2021-12-21T18:45:50.844716766Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Collabora Online Development Edition – an awesome, Online Office + suite image suitable for home use. + digest: ea5caee66d48456a1a5585a4a5112a67be7a23f8f238e71e4241f4f9605100cb + home: https://github.com/truecharts/apps/tree/master/charts/stable/collabora-online + icon: https://truecharts.org/_static/img/appicons/collabora-online-icon.png + keywords: + - collabora-online + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: collabora-online + sources: + - https://hub.docker.com/r/collabora/code + - https://sdk.collaboraonline.com/contents.html + - https://github.com/CollaboraOnline/online/tree/master/kubernetes/helm + type: application + urls: + - https://github.com/truecharts/apps/releases/download/collabora-online-10.0.7/collabora-online-10.0.7.tgz + version: 10.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -3395,6 +4168,36 @@ entries: - https://github.com/truecharts/apps/releases/download/common-test-3.3.6/common-test-3.3.6.tgz version: 3.3.6 couchpotato: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.22 + created: "2021-12-21T18:45:51.011191747Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Couchpotato is an automatic NZB and torrent downloader. + digest: 061c32635d7f79066784b52ac76487d99ec94024d7481c450ed7fa5410a344cb + home: https://github.com/truecharts/apps/tree/master/charts/stable/couchpotato + icon: https://truecharts.org/_static/img/appicons/couchpotato-icon.png + keywords: + - couchpotato + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: couchpotato + sources: + - https://hub.docker.com/r/linuxserver/couchpotato + type: application + urls: + - https://github.com/truecharts/apps/releases/download/couchpotato-0.0.7/couchpotato-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -3516,6 +4319,35 @@ entries: - https://github.com/truecharts/apps/releases/download/couchpotato-0.0.1/couchpotato-0.0.1.tgz version: 0.0.1 cryptofolio: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.2.0 + created: "2021-12-21T18:45:51.196144727Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Track your cryptocurrency holdings/portfolio + digest: a353b5dc8e8742ba8be18bb48ea85796bc77f2ae61421ec0fec69ff9d6114f5d + home: https://github.com/truecharts/apps/tree/master/charts/stable/cryptofolio + icon: https://truecharts.org/_static/img/appicons/cryptofolio-icon.png + keywords: + - cryptofolio + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: cryptofolio + sources: + - https://github.com/Xtrendence/cryptofolio + urls: + - https://github.com/truecharts/apps/releases/download/cryptofolio-2.0.26/cryptofolio-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -3604,6 +4436,36 @@ entries: - https://github.com/truecharts/apps/releases/download/cryptofolio-2.0.21/cryptofolio-2.0.21.tgz version: 2.0.21 custom-app: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - custom + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.20.184 + created: "2021-12-21T18:45:51.362056021Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Advanced tool to create your own TrueCharts-based App + digest: 0ce4d2700f7ffc1da9f8699e11562d8d5625d5556aa72e870cc515bd1b01b24d + home: https://github.com/truecharts/apps/tree/master/charts/stable/custom-app + icon: https://truecharts.org/_static/img/appicons/custom-app-icon.png + keywords: + - custom + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: custom-app + sources: + - https://github.com/truecharts/apps/tree/master/charts/stable/custom-app + type: application + urls: + - https://github.com/truecharts/apps/releases/download/custom-app-3.0.45/custom-app-3.0.45.tgz + version: 3.0.45 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -3905,6 +4767,37 @@ entries: - https://github.com/truecharts/apps/releases/download/custom-app-3.0.30/custom-app-3.0.30.tgz version: 3.0.30 darktable: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.4.1 + created: "2021-12-21T18:45:51.534978062Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Darktable is an open source photography workflow application and + raw developer. + digest: 98d6229c6fbebd6fda4c0090237cdf631acdd777499ed780217a022e9ae8ed2e + home: https://github.com/truecharts/apps/tree/master/charts/stable/darktable + icon: https://truecharts.org/_static/img/appicons/darktable-icon.png + keywords: + - darktable + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: darktable + sources: + - https://hub.docker.com/r/linuxserver/darktable + type: application + urls: + - https://github.com/truecharts/apps/releases/download/darktable-0.0.7/darktable-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4030,6 +4923,40 @@ entries: - https://github.com/truecharts/apps/releases/download/darktable-0.0.1/darktable-0.0.1.tgz version: 0.0.1 davos: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.2.1 + created: "2021-12-21T18:45:51.678404544Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An FTP automation tool that periodically scans given host locations + for new files. + digest: 43df70a4e7ed6ec9e7b6c67db4a747a04710bbdb7a3b1eea70340c6d86d9430d + home: https://github.com/truecharts/apps/tree/master/charts/stable/davos + icon: https://truecharts.org/_static/img/appicons/davos-icon.png + keywords: + - davos + - ftp + - automation + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: davos + sources: + - https://github.com/linuxserver/docker-davos + - https://github.com/linuxserver/davos/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/davos-2.0.26/davos-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4133,6 +5060,37 @@ entries: - https://github.com/truecharts/apps/releases/download/davos-2.0.21/davos-2.0.21.tgz version: 2.0.21 ddclient: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.9.1 + created: "2021-12-21T18:45:51.825172554Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Ddclient is a Perl client used to update dynamic DNS entries for + accounts on Dynamic DNS Network Service Provider. + digest: 9668d7a16e6044a661b3065d13d301b460453a4894245a0a54863f9d3858565f + home: https://github.com/truecharts/apps/tree/master/charts/stable/ddclient + icon: https://truecharts.org/_static/img/appicons/ddclient-icon.png + keywords: + - ddclient + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ddclient + sources: + - https://hub.docker.com/r/linuxserver/ddclient + type: application + urls: + - https://github.com/truecharts/apps/releases/download/ddclient-0.0.7/ddclient-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4258,6 +5216,40 @@ entries: - https://github.com/truecharts/apps/releases/download/ddclient-0.0.1/ddclient-0.0.1.tgz version: 0.0.1 deconz: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.13.01 + created: "2021-12-21T18:45:51.987024436Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: deCONZ is an easy to use control software, with which you can set + up and control Zigbee networks of any size without further programming effort. + digest: aea6a099bb8f64ab51d5deb0ad2edde7843668ec048862eb8df2dda1f5fc4c62 + home: https://github.com/truechartsapps/tree/master/charts/stable/deconz + icon: https://truecharts.org/_static/img/appicons/deconz-icon.png + keywords: + - deconz + - home-automation + - zigbee + - conbee + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: deconz + sources: + - https://github.com/dresden-elektronik/deconz-rest-plugin + - https://github.com/marthoc/docker-deconz + urls: + - https://github.com/truecharts/apps/releases/download/deconz-6.0.7/deconz-6.0.7.tgz + version: 6.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4429,6 +5421,39 @@ entries: - https://github.com/truecharts/apps/releases/download/deconz-5.0.7/deconz-5.0.7.tgz version: 5.0.7 deepstack-cpu: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - AI + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.09.1 + created: "2021-12-21T18:45:52.178777968Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: DeepStack AI provides AI features including Face Recognition, Object + Detection, Scene Recognition and custom AI Models + digest: cf07dfe0e31c604995c565ef06c1583f27565df3ac9820a24026f13ac70e6f7e + home: https://github.com/truecharts/apps/tree/master/charts/stable/deepstack-cpu + icon: https://truecharts.org/_static/img/appicons/deepstack-cpu-icon.png + keywords: + - AI + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: deepstack-cpu + sources: + - https://github.com/johnolafenwa/DeepStack + - https://hub.docker.com/r/deepquestai/deepstack + - https://www.deepstack.cc/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/deepstack-cpu-8.0.8/deepstack-cpu-8.0.8.tgz + version: 8.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4595,6 +5620,39 @@ entries: - https://github.com/truecharts/apps/releases/download/deepstack-cpu-8.0.0/deepstack-cpu-8.0.0.tgz version: 8.0.0 deepstack-gpu: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - AI + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.09.1 + created: "2021-12-21T18:45:52.334409485Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: DeepStack AI provides AI features including Face Recognition, Object + Detection, Scene Recognition and custom AI Models + digest: 0cc082814a7b8eb407dfe5af0c909ff6f9ba7d1675c4258ea8c37be057f8b236 + home: https://github.com/truecharts/apps/tree/master/charts/stable/deepstack-gpu + icon: https://truecharts.org/_static/img/appicons/deepstack-gpu-icon.png + keywords: + - AI + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: deepstack-gpu + sources: + - https://github.com/johnolafenwa/DeepStack + - https://hub.docker.com/r/deepquestai/deepstack + - https://www.deepstack.cc/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/deepstack-gpu-3.0.8/deepstack-gpu-3.0.8.tgz + version: 3.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4761,6 +5819,38 @@ entries: - https://github.com/truecharts/apps/releases/download/deepstack-gpu-3.0.0/deepstack-gpu-3.0.0.tgz version: 3.0.0 deluge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.3 + created: "2021-12-21T18:45:52.477166782Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Deluge App for TrueNAS SCALE + digest: 7d6aad74a30063a444da6d123e06b52f4e93587fe786ad9146d198f87784dec1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/deluge + icon: https://truecharts.org/_static/img/appicons/deluge-icon.png + keywords: + - transmission + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: deluge + sources: + - https://github.com/deluge-torrent/deluge + type: application + urls: + - https://github.com/truecharts/apps/releases/download/deluge-9.0.27/deluge-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4858,6 +5948,41 @@ entries: - https://github.com/truecharts/apps/releases/download/deluge-9.0.22/deluge-9.0.22.tgz version: 9.0.22 digikam: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 7.3.0 + created: "2021-12-21T18:45:52.634803255Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Professional Photo Management with the Power of Open Source + digest: 4ff36dc5461cd69c34728e56ec1470fe40acc980d295b81df2d225e793c17603 + home: https://github.com/truecharts/apps/tree/master/charts/stable/digikam + icon: https://truecharts.org/_static/img/appicons/digikam-icon.png + keywords: + - digikam + - photo + - management + - image + - gallery + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: digikam + sources: + - https://github.com/linuxserver/docker-digikam + - https://www.digikam.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/digikam-2.0.28/digikam-2.0.28.tgz + version: 2.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -4964,6 +6089,37 @@ entries: - https://github.com/truecharts/apps/releases/download/digikam-2.0.23/digikam-2.0.23.tgz version: 2.0.23 dillinger: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.39.1 + created: "2021-12-21T18:45:52.778875524Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Dillinger is a cloud-enabled, mobile-ready, offline-storage, AngularJS + powered HTML5 Markdown editor. + digest: 856b98b1fdf46735dce1fba9c2d658a2c4573fa3c8be3631dfbbc9439e4bee95 + home: https://github.com/truecharts/apps/tree/master/charts/stable/dillinger + icon: https://truecharts.org/_static/img/appicons/dillinger-icon.png + keywords: + - dillinger + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: dillinger + sources: + - https://hub.docker.com/r/linuxserver/dillinger + type: application + urls: + - https://github.com/truecharts/apps/releases/download/dillinger-0.0.7/dillinger-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5089,6 +6245,37 @@ entries: - https://github.com/truecharts/apps/releases/download/dillinger-0.0.1/dillinger-0.0.1.tgz version: 0.0.1 dizquetv: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.5.0 + created: "2021-12-21T18:45:52.922475002Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Create live TV channel streams from media on your Plex servers. + digest: f099e350c333949229ee9c8574098f37a81416f86088232d1c255badd91b1940 + home: https://github.com/truechartsapps/tree/master/charts/stable/dizquetv + icon: https://truecharts.org/_static/img/appicons/dizquetv-icon.png + keywords: + - dizqueTV + - dizquetv + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: dizquetv + sources: + - https://github.com/vexorian/dizquetv + - https://hub.docker.com/r/vexorian/dizquetv + urls: + - https://github.com/truecharts/apps/releases/download/dizquetv-5.0.7/dizquetv-5.0.7.tgz + version: 5.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5245,6 +6432,37 @@ entries: - https://github.com/truecharts/apps/releases/download/dizquetv-4.0.19/dizquetv-4.0.19.tgz version: 4.0.19 dokuwiki: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.28 + created: "2021-12-21T18:45:53.078491511Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Dokuwiki is a simple to use and highly versatile Open Source wiki + software that doesn't require a database. + digest: 8a2bcecf1d902e3b8ce46828427ae5133534866750e55c608b1ac2b15f3be658 + home: https://github.com/truecharts/apps/tree/master/charts/stable/dokuwiki + icon: https://truecharts.org/_static/img/appicons/dokuwiki-icon.png + keywords: + - dokuwiki + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: dokuwiki + sources: + - https://hub.docker.com/r/linuxserver/dokuwiki + type: application + urls: + - https://github.com/truecharts/apps/releases/download/dokuwiki-0.0.7/dokuwiki-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5370,6 +6588,37 @@ entries: - https://github.com/truecharts/apps/releases/download/dokuwiki-0.0.1/dokuwiki-0.0.1.tgz version: 0.0.1 domoticz: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.1.202 + created: "2021-12-21T18:45:53.225719311Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Domoticz is a Home Automation System that lets you monitor and configure + various devices like Lights, Switches and much more. + digest: 66d87d0665526933f451345597c757fcb28d1701c9bd930e19f708f7878420a8 + home: https://github.com/truecharts/apps/tree/master/charts/stable/domoticz + icon: https://truecharts.org/_static/img/appicons/domoticz-icon.png + keywords: + - domoticz + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: domoticz + sources: + - https://hub.docker.com/r/linuxserver/domoticz + type: application + urls: + - https://github.com/truecharts/apps/releases/download/domoticz-0.0.9/domoticz-0.0.9.tgz + version: 0.0.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5557,6 +6806,40 @@ entries: - https://github.com/truecharts/apps/releases/download/domoticz-0.0.1/domoticz-0.0.1.tgz version: 0.0.1 doublecommander: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.8.2 + created: "2021-12-21T18:45:53.378257795Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A free cross platform open source file manager with two panels side + by side. + digest: 05ad85494debf73d6f3bedb1c55bd83707219307a4d66b9e27b32a61913382e0 + home: https://github.com/truecharts/apps/tree/master/charts/stable/doublecommander + icon: https://truecharts.org/_static/img/appicons/doublecommander-icon.png + keywords: + - doublecommander + - file + - manager + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: doublecommander + sources: + - https://github.com/linuxserver/docker-doublecommander + - https://doublecmd.sourceforge.io/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/doublecommander-2.0.29/doublecommander-2.0.29.tgz + version: 2.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5660,6 +6943,42 @@ entries: - https://github.com/truecharts/apps/releases/download/doublecommander-2.0.24/doublecommander-2.0.24.tgz version: 2.0.24 dsmr-reader: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.09.02 + created: "2021-12-21T18:45:53.549310077Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: DSMR-protocol reader, telegram data storage and energy consumption + visualizer. + digest: a85757a2567de72e457d986cc59f7bb775878f07359d541a90a5f814a5daec00 + home: https://github.com/truecharts/apps/tree/master/charts/stable/dsmr-reader + icon: https://truecharts.org/_static/img/appicons/dsmr-reader-icon.png + keywords: + - dsmr-reader + - energy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: dsmr-reader + sources: + - https://github.com/dsmrreader/dsmr-reader + - https://github.com/xirixiz/dsmr-reader-docker + urls: + - https://github.com/truecharts/apps/releases/download/dsmr-reader-5.0.16/dsmr-reader-5.0.16.tgz + version: 5.0.16 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5769,6 +7088,37 @@ entries: - https://github.com/truecharts/apps/releases/download/dsmr-reader-5.0.11/dsmr-reader-5.0.11.tgz version: 5.0.11 duckdns: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.17 + created: "2021-12-21T18:45:53.710321077Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Duckdns is a free service which will point a DNS (sub domains of + duckdns.org) to an IP of your choice. + digest: 654522d5f7de52288418e04a5aca3d79741172a0bffd3e0566f8fc4ed99714ce + home: https://github.com/truecharts/apps/tree/master/charts/stable/duckdns + icon: https://truecharts.org/_static/img/appicons/duckdns-icon.png + keywords: + - duckdns + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: duckdns + sources: + - https://hub.docker.com/r/linuxserver/duckdns + type: application + urls: + - https://github.com/truecharts/apps/releases/download/duckdns-0.0.7/duckdns-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5894,6 +7244,36 @@ entries: - https://github.com/truecharts/apps/releases/download/duckdns-0.0.1/duckdns-0.0.1.tgz version: 0.0.1 duplicati: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: beta + created: "2021-12-21T18:45:53.862594867Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Store securely encrypted backups on cloud storage services! + digest: 37d18c67b0d5cfac05bd8ed54cddfff890d5b56a79e0df7634c011cd51926fdd + home: https://github.com/truechartsapps/tree/master/charts/stable/duplicati + icon: https://truecharts.org/_static/img/appicons/duplicati-icon.png + keywords: + - duplicati + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: duplicati + sources: + - https://hub.docker.com/r/linuxserver/duplicati/ + - https://github.com/duplicati/duplicati + urls: + - https://github.com/truecharts/apps/releases/download/duplicati-4.0.26/duplicati-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -5985,6 +7365,39 @@ entries: - https://github.com/truecharts/apps/releases/download/duplicati-4.0.21/duplicati-4.0.21.tgz version: 4.0.21 emby: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.6.7.0 + created: "2021-12-21T18:45:54.010344855Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Emby Server is a home media server + digest: f44f7f5a9a5f7920b260709971d0ccccf4eeb033017edecdfa63791b12bea7e3 + home: https://github.com/truecharts/apps/master/stable/emby + icon: https://truecharts.org/_static/img/appicons/emby-icon.png + keywords: + - jellyfin + - plex + - emby + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: emby + sources: + - https://hub.docker.com/r/linuxserver/emby + - https://github.com/linuxserver/docker-emby.git + type: application + urls: + - https://github.com/truecharts/apps/releases/download/emby-9.0.28/emby-9.0.28.tgz + version: 9.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6085,6 +7498,37 @@ entries: - https://github.com/truecharts/apps/releases/download/emby-9.0.23/emby-9.0.23.tgz version: 9.0.23 embystat: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.2.0 + created: "2021-12-21T18:45:54.151223193Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Embystat is a personal web server that can calculate all kinds of + statistics from your (local) Emby server. + digest: e39fdf4cc64c0e193b3ae939bb677796a2182db21272cec8e46835f027634bda + home: https://github.com/truecharts/apps/tree/master/charts/stable/embystat + icon: https://truecharts.org/_static/img/appicons/embystat-icon.png + keywords: + - embystat + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: embystat + sources: + - https://hub.docker.com/r/linuxserver/embystat + type: application + urls: + - https://github.com/truecharts/apps/releases/download/embystat-0.0.7/embystat-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6210,6 +7654,37 @@ entries: - https://github.com/truecharts/apps/releases/download/embystat-0.0.1/embystat-0.0.1.tgz version: 0.0.1 emulatorjs: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.4.2 + created: "2021-12-21T18:45:54.306641115Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Emulatorjs - In browser web based emulation portable to nearly any + device for many retro consoles. + digest: 607ed879619b227d32f2f292b010280e3c1962354d790d2bff2e4957fa128a77 + home: https://github.com/truecharts/apps/tree/master/charts/stable/emulatorjs + icon: https://truecharts.org/_static/img/appicons/emulatorjs-icon.png + keywords: + - emulatorjs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: emulatorjs + sources: + - https://hub.docker.com/r/linuxserver/emulatorjs + type: application + urls: + - https://github.com/truecharts/apps/releases/download/emulatorjs-0.0.9/emulatorjs-0.0.9.tgz + version: 0.0.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6397,6 +7872,37 @@ entries: - https://github.com/truecharts/apps/releases/download/emulatorjs-0.0.1/emulatorjs-0.0.1.tgz version: 0.0.1 endlessh: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.21 + created: "2021-12-21T18:45:54.506166778Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Endlessh is an SSH tarpit that very slowly sends an endless, random + SSH banner. + digest: ab591980c3e95c958f740a70169bc7e299d93942253c42b257a0933361134683 + home: https://github.com/truecharts/apps/tree/master/charts/stable/endlessh + icon: https://truecharts.org/_static/img/appicons/endlessh-icon.png + keywords: + - endlessh + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: endlessh + sources: + - https://hub.docker.com/r/linuxserver/endlessh + type: application + urls: + - https://github.com/truecharts/apps/releases/download/endlessh-0.0.7/endlessh-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6522,6 +8028,38 @@ entries: - https://github.com/truecharts/apps/releases/download/endlessh-0.0.1/endlessh-0.0.1.tgz version: 0.0.1 esphome: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - tools + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.12.1 + created: "2021-12-21T18:45:54.647841281Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: ESPHome is a system to control your ESP8266/ESP32 by simple yet powerful + configuration files and control them remotely through Home Automation systems. + digest: 65686387e4110bc0599d1ea29dab34b4d49b0060aa72371b7d88c9f8a2cdfe7a + home: https://github.com/truecharts/apps/tree/master/charts/stable/esphome + icon: https://truecharts.org/_static/img/appicons/esphome-icon.png + keywords: + - esphome + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: esphome + sources: + - https://github.com/esphome/esphome + - https://hub.docker.com/u/esphome + type: application + urls: + - https://github.com/truecharts/apps/releases/download/esphome-9.0.31/esphome-9.0.31.tgz + version: 9.0.31 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6683,6 +8221,46 @@ entries: - https://github.com/truecharts/apps/releases/download/esphome-9.0.23/esphome-9.0.23.tgz version: 9.0.23 etherpad: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.8.14 + created: "2021-12-21T18:45:54.814254068Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: A real-time collaborative editor scalable to thousands of simultaneous + real time users. + digest: be562733adf6ba6a519563c6dcf3a60645e7d6ec631fc0c46a7c3f66e8277b94 + home: https://github.com/truecharts/apps/tree/main/charts/etherpad + icon: https://truecharts.org/_static/img/appicons/etherpad-icon.png + keywords: + - etherpad + - editor + - notepad + - pad + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: etherpad + sources: + - https://etherpad.org/ + - https://github.com/ether/etherpad-lite + - https://hub.docker.com/r/nicholaswilde/etherpad + type: application + urls: + - https://github.com/truecharts/apps/releases/download/etherpad-5.0.17/etherpad-5.0.17.tgz + version: 5.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6804,6 +8382,37 @@ entries: - https://github.com/truecharts/apps/releases/download/etherpad-5.0.12/etherpad-5.0.12.tgz version: 5.0.12 external-service: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - networking + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.66.6 + created: "2021-12-21T18:45:54.979430785Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Allow external services to be used like Apps. + digest: 097f361abb61b8adf17cbbcf62fb1e056cc0dd0ecc874ce49268caa9b1e934e0 + home: https://github.com/truecharts/apps/tree/master/charts/stable/external-service + icon: https://truecharts.org/_static/img/appicons/external-service-icon.png + keywords: + - external-service + - reverse-proxy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: external-service + sources: + - https://github.com/truecharts/apps/tree/master/charts/stable/external-service + type: application + urls: + - https://github.com/truecharts/apps/releases/download/external-service-4.0.25/external-service-4.0.25.tgz + version: 4.0.25 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -6898,6 +8507,41 @@ entries: - https://github.com/truecharts/apps/releases/download/external-service-4.0.20/external-service-4.0.20.tgz version: 4.0.20 filezilla: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.51.0 + created: "2021-12-21T18:45:55.121485289Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A Helm chart for Kubernetes + digest: c774b1df3a834a45014e05beee5c6737297875eae353f81437baeb3cbe43a506 + home: https://github.com/truecharts/apps/tree/master/charts/stable/filezilla + icon: https://truecharts.org/_static/img/appicons/filezilla-icon.png + keywords: + - filezilla + - ftp + - sftp + - ftps + - client + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: filezilla + sources: + - https://filezilla-project.org/ + - https://github.com/linuxserver/docker-filezilla + type: application + urls: + - https://github.com/truecharts/apps/releases/download/filezilla-2.0.26/filezilla-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7004,6 +8648,45 @@ entries: - https://github.com/truecharts/apps/releases/download/filezilla-2.0.21/filezilla-2.0.21.tgz version: 2.0.21 fireflyiii: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - finacial + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.6.5 + created: "2021-12-21T18:45:55.331690067Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: A free and open source personal finance manager + digest: d84055cdd567325a08e8ee8335405b2ccf20ce453a3300e5c3b41576c01104d9 + home: https://github.com/firefly-iii/firefly-iii/ + icon: https://truecharts.org/_static/img/appicons/fireflyiii-icon.png + keywords: + - fireflyiii + - finacial + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: fireflyiii + sources: + - https://github.com/firefly-iii/firefly-iii/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/fireflyiii-13.1.8/fireflyiii-13.1.8.tgz + version: 13.1.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7192,6 +8875,36 @@ entries: - https://github.com/truecharts/apps/releases/download/fireflyiii-13.0.10/fireflyiii-13.0.10.tgz version: 13.0.10 firefox: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 78.15.0 + created: "2021-12-21T18:45:55.480163407Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Firefox Browser, also known as Mozilla Firefox or simply Firefox, + digest: 26124dc864b83619f862e24e3b222b2f4dec50aa7a079168c20d3ce46e05f88e + home: https://github.com/truecharts/apps/tree/master/charts/stable/firefox + icon: https://truecharts.org/_static/img/appicons/firefox-icon.png + keywords: + - firefox + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: firefox + sources: + - https://hub.docker.com/r/linuxserver/firefox + type: application + urls: + - https://github.com/truecharts/apps/releases/download/firefox-0.0.7/firefox-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7313,6 +9026,45 @@ entries: - https://github.com/truecharts/apps/releases/download/firefox-0.0.1/firefox-0.0.1.tgz version: 0.0.1 firefox-syncserver: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.8.0 + created: "2021-12-21T18:45:55.643814964Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: This is an all-in-one package for running a self-hosted Firefox Sync + server. + digest: 26530eebd355304b67ec8df0d97cdd83d3815b74132432716c15ff50a0f3fac1 + home: https://github.com/truecharts/apps/tree/main/charts/firefox-syncserver + icon: https://truecharts.org/_static/img/appicons/firefox-syncserver-icon.png + keywords: + - server + - sync + - syncserver + - firefox + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: firefox-syncserver + sources: + - https://moz-services-docs.readthedocs.io/en/latest/howtos/run-sync-1.5.html + - https://hub.docker.com/r/crazymax/firefox-syncserver + type: application + urls: + - https://github.com/truecharts/apps/releases/download/firefox-syncserver-5.0.17/firefox-syncserver-5.0.17.tgz + version: 5.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7431,6 +9183,37 @@ entries: - https://github.com/truecharts/apps/releases/download/firefox-syncserver-5.0.12/firefox-syncserver-5.0.12.tgz version: 5.0.12 flaresolverr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.0 + created: "2021-12-21T18:45:55.791473925Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: FlareSolverr is a proxy server to bypass Cloudflare protection + digest: 671eab1369ec52beb2885c2e18e9d4630ec93514cf4c2487480a6313f56e5867 + home: https://github.com/truechartsapps/tree/master/charts/stable/flaresolverr + icon: https://truecharts.org/_static/img/appicons/flaresolverr-icon.png + keywords: + - flaresolverr + - jackett + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: flaresolverr + sources: + - https://github.com/FlareSolverr/FlareSolverr + - https://hub.docker.com/r/flaresolverr/flaresolverr + urls: + - https://github.com/truecharts/apps/releases/download/flaresolverr-4.0.28/flaresolverr-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7556,6 +9339,41 @@ entries: - https://github.com/truecharts/apps/releases/download/flaresolverr-4.0.22/flaresolverr-4.0.22.tgz version: 4.0.22 fleet: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.3.2 + created: "2021-12-21T18:45:55.956291152Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: Fleet provides an online web interface which displays a set of maintained + images from one or more owned repositories. + digest: e4779804fbf699a5e6810879c832c6609e934f9cb682cf811cd3f2be0429a571 + home: https://github.com/truecharts/apps/tree/master/charts/stable/fleet + icon: https://truecharts.org/_static/img/appicons/fleet-icon.png + keywords: + - fleet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: fleet + sources: + - https://hub.docker.com/r/linuxserver/fleet + type: application + urls: + - https://github.com/truecharts/apps/releases/download/fleet-0.0.7/fleet-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7697,6 +9515,39 @@ entries: - https://github.com/truecharts/apps/releases/download/fleet-0.0.1/fleet-0.0.1.tgz version: 0.0.1 flood: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.7.0 + created: "2021-12-21T18:45:56.099061837Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Flood is a monitoring service for various torrent clients + digest: d9b311ac641b914854137b2ad032aa95be78c372e614c7763b9e04c03acc14c6 + home: https://github.com/truechartsapps/tree/master/charts/stable/flood + icon: https://truecharts.org/_static/img/appicons/flood-icon.png + keywords: + - flood + - rtorrent + - qbittorrent + - transmission + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: flood + sources: + - https://github.com/jesec/flood + - https://hub.docker.com/r/jesec/flood + urls: + - https://github.com/truecharts/apps/releases/download/flood-4.0.26/flood-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7830,6 +9681,40 @@ entries: - https://github.com/truecharts/apps/releases/download/flood-4.0.19/flood-4.0.19.tgz version: 4.0.19 focalboard: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.8.0 + created: "2021-12-21T18:45:56.244190863Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Focalboard is an open source, self-hosted alternative to Trello, + Notion, and Asana. + digest: 07c20b79eda9b72cdcaafb1d3191a3445d5ee71483385939d33b84ec26f729fd + home: https://github.com/truechartsapps/tree/master/charts/stable/focalboard + icon: https://truecharts.org/_static/img/appicons/focalboard-icon.png + keywords: + - focalboard + - kanban + - project management + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: focalboard + sources: + - https://www.focalboard.com/ + - https://github.com/mattermost/focalboard + - https://github.com/FlipEnergy/container-images/blob/main/focalboard + urls: + - https://github.com/truecharts/apps/releases/download/focalboard-4.0.27/focalboard-4.0.27.tgz + version: 4.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -7967,6 +9852,38 @@ entries: - https://github.com/truecharts/apps/releases/download/focalboard-4.0.20/focalboard-4.0.20.tgz version: 4.0.20 foldingathome: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 7.6.21 + created: "2021-12-21T18:45:56.389320588Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Folding@home is a distributed computing project for simulating protein + dynamics, including the process of protein folding and the movements of proteins + implicated in a variety of diseases. + digest: a0f342348c3553a0364cd4fb1589562d86ab3409c8278da82bf0bd2b43b2c0ce + home: https://github.com/truecharts/apps/tree/master/charts/stable/foldingathome + icon: https://truecharts.org/_static/img/appicons/foldingathome-icon.png + keywords: + - foldingathome + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: foldingathome + sources: + - https://hub.docker.com/r/linuxserver/foldingathome + type: application + urls: + - https://github.com/truecharts/apps/releases/download/foldingathome-0.0.8/foldingathome-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8128,6 +10045,38 @@ entries: - https://github.com/truecharts/apps/releases/download/foldingathome-0.0.1/foldingathome-0.0.1.tgz version: 0.0.1 fossil: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.15.1 + created: "2021-12-21T18:45:56.548057969Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A simple, high-reliability, distributed software configuration management + system + digest: f9104f3f635211b9217177405c4182f44be0583bd9512d7a11a810508d6cf6c7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/fossil + icon: https://truecharts.org/_static/img/appicons/fossil-icon.png + keywords: + - fossil + - scm + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: fossil + sources: + - https://fossil-scm.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/fossil-2.0.26/fossil-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8225,6 +10174,38 @@ entries: - https://github.com/truecharts/apps/releases/download/fossil-2.0.21/fossil-2.0.21.tgz version: 2.0.21 freeradius: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - auth + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.0.25 + created: "2021-12-21T18:45:56.696230117Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: OpenSource Radius implementation + digest: 00c606f0a0027ccdeedce475ab92d3ed87bc6b6dbd8014e07d95f97df822c29e + home: https://www.openldap.org + icon: https://truecharts.org/_static/img/appicons/freeradius-icon.png + keywords: + - radius + - auth + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: freeradius + sources: + - https://hub.docker.com/r/freeradius/freeradius-server/ + - https://freeradius.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/freeradius-4.0.29/freeradius-4.0.29.tgz + version: 4.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8354,6 +10335,38 @@ entries: - https://github.com/truecharts/apps/releases/download/freeradius-4.0.23/freeradius-4.0.23.tgz version: 4.0.23 freshrss: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.18.1 + created: "2021-12-21T18:45:56.857387937Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: FreshRSS is a self-hosted RSS feed aggregator + digest: 91e6da3aa2fbaca4c553238689436cf56a624f1ffb6008e099c028d31e7d2383 + home: https://github.com/truecharts/apps/tree/master/charts/stable/freshrss + icon: https://truecharts.org/_static/img/appicons/freshrss-icon.png + keywords: + - freshrss + - rss + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: freshrss + sources: + - https://github.com/FreshRSS/FreshRSS + - https://hub.docker.com/r/linuxserver/freshrss + type: application + urls: + - https://github.com/truecharts/apps/releases/download/freshrss-9.0.30/freshrss-9.0.30.tgz + version: 9.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8451,6 +10464,45 @@ entries: - https://github.com/truecharts/apps/releases/download/freshrss-9.0.25/freshrss-9.0.25.tgz version: 9.0.25 friendica: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - social + truecharts.org/grade: U + apiVersion: v2 + appVersion: "2021.09" + created: "2021-12-21T18:45:57.041022488Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: Welcome to the free social web + digest: 60685cebc9e4f7213e7255046f107578c1fb10513a09c8064d6a3f19076482f8 + home: https://github.com/truechartsapps/tree/master/charts/stable/friendica + icon: https://truecharts.org/_static/img/appicons/friendica-icon.png + keywords: + - friend + - social + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: friendica + sources: + - https://friendi.ca/ + - https://hub.docker.com/_/friendica + urls: + - https://github.com/truecharts/apps/releases/download/friendica-0.0.18/friendica-0.0.18.tgz + version: 0.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8608,6 +10660,39 @@ entries: - https://github.com/truecharts/apps/releases/download/friendica-0.0.10/friendica-0.0.10.tgz version: 0.0.10 gaps: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.8.8 + created: "2021-12-21T18:45:57.191737872Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Gaps searches through your Plex Server or local folders for all movies, + then queries for known movies in the same collection. + digest: 0d98a83d1d2e6eb8e7f1384489e1d7cb91a27de3aa83143bce9351fd2d20ef61 + home: https://github.com/truecharts/apps/tree/master/charts/stable/gaps + icon: https://truecharts.org/_static/img/appicons/gaps-icon.png + keywords: + - gaps + - plex + - plex-media-server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: gaps + sources: + - https://github.com/JasonHHouse/gaps + type: application + urls: + - https://github.com/truecharts/apps/releases/download/gaps-9.0.27/gaps-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8741,6 +10826,51 @@ entries: - https://github.com/truecharts/apps/releases/download/gaps-9.0.20/gaps-9.0.20.tgz version: 9.0.20 gitea: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - GIT + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.15.7 + created: "2021-12-21T18:45:57.370655141Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + - condition: memcached.enabled + name: memcached + repository: https://truecharts.org/ + version: 1.0.39 + description: Self hosted GIT repositories + digest: 1a32206bd2d4288c115ad64204132a097f67531fcdf70555dc2afbba62ff43b7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/gitea + icon: https://truecharts.org/_static/img/appicons/gitea-icon.png + keywords: + - git + - issue tracker + - code review + - wiki + - gitea + - gogs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: gitea + sources: + - https://gitea.com/gitea/helm-chart + - https://github.com/go-gitea/gitea + - https://hub.docker.com/r/gitea/gitea/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/gitea-5.0.20/gitea-5.0.20.tgz + version: 5.0.20 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -8967,6 +11097,42 @@ entries: - https://github.com/truecharts/apps/releases/download/gitea-5.0.11/gitea-5.0.11.tgz version: 5.0.11 golinks: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 154c581 + created: "2021-12-21T18:45:57.516726343Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A web app that allows you to create smart bookmarks, commands and + aliases by pointing your web browser's default search engine at a running instance. + digest: 2ac9489391e99b74a2064e0b94f8345fe9126e429fb55ad7708e38132e18fc1d + home: https://github.com/truecharts/apps/tree/master/charts/stable/golinks + icon: https://truecharts.org/_static/img/appicons/golinks-icon.png + keywords: + - search + - browser + - bookmarks + - smart-bookmarks + - golinks + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: golinks + sources: + - https://github.com/prologic/golinks + - https://github.com/nicholaswilde/docker-golinks + type: application + urls: + - https://github.com/truecharts/apps/releases/download/golinks-2.0.26/golinks-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9076,6 +11242,37 @@ entries: - https://github.com/truecharts/apps/releases/download/golinks-2.0.21/golinks-2.0.21.tgz version: 2.0.21 gonic: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.14.0 + created: "2021-12-21T18:45:57.676748891Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Music streaming server / subsonic server API implementation + digest: c782f2439568cbadb46dcf3dc62d0d7fda18639a26a298df74e85ff7a36a372d + home: https://github.com/truechartsapps/tree/master/charts/stable/gonic + icon: https://truecharts.org/_static/img/appicons/gonic-icon.png + keywords: + - music + - subsonic + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: gonic + sources: + - https://github.com/sentriz/gonic + - https://hub.docker.com/r/sentriz/gonic + urls: + - https://github.com/truecharts/apps/releases/download/gonic-4.0.26/gonic-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9201,6 +11398,44 @@ entries: - https://github.com/truecharts/apps/releases/download/gonic-4.0.19/gonic-4.0.19.tgz version: 4.0.19 gotify: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.3 + created: "2021-12-21T18:45:57.836076657Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: a simple server for sending and receiving messages + digest: b082758f9aca73fd8ee06e55f883a682955b5af060e15143a1a17559cc23f684 + home: https://github.com/truecharts/apps/tree/main/charts/gotify + icon: https://truecharts.org/_static/img/appicons/gotify-icon.png + keywords: + - server + - gotify + - messages + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: gotify + sources: + - https://gotify.net/ + - https://github.com/gotify/server + - https://hub.docker.com/r/gotify/server + type: application + urls: + - https://github.com/truecharts/apps/releases/download/gotify-5.0.18/gotify-5.0.18.tgz + version: 5.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9316,6 +11551,41 @@ entries: - https://github.com/truecharts/apps/releases/download/gotify-5.0.13/gotify-5.0.13.tgz version: 5.0.13 grafana: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: 8.3.3 + created: "2021-12-21T18:45:57.9963186Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Grafana is an open source, feature rich metrics dashboard and graph + editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB. + digest: 56574316eaa327d7143b95e007756790faf6c350749e3ebc738cd09bdd9aac12 + home: https://github.com/truecharts/apps/tree/master/charts/stable/grafana + icon: https://truecharts.org/_static/img/appicons/grafana-icon.png + keywords: + - analytics + - monitoring + - metrics + - logs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: grafana + sources: + - https://github.com/bitnami/bitnami-docker-grafana + - https://grafana.com/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/grafana-2.0.11/grafana-2.0.11.tgz + version: 2.0.11 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9667,6 +11937,40 @@ entries: - https://github.com/truecharts/apps/releases/download/grafana-1.0.11/grafana-1.0.11.tgz version: 1.0.11 grav: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.7.18 + created: "2021-12-21T18:45:58.146616995Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A Fast, Simple, and Flexible, file-based Web-platform. + digest: 06f4a45658a3d30ddd89fc5e8ddc0c7b526b1af1933d121956cc57264635beb1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/grav + icon: https://truecharts.org/_static/img/appicons/grav-icon.png + keywords: + - grav + - web + - platform + - file + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: grav + sources: + - https://github.com/linuxserver/docker-grav + - https://github.com/getgrav/grav/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/grav-2.0.26/grav-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9770,6 +12074,37 @@ entries: - https://github.com/truecharts/apps/releases/download/grav-2.0.21/grav-2.0.21.tgz version: 2.0.21 grocy: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - Home-Automation + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.1.1 + created: "2021-12-21T18:45:58.307905511Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: ERP beyond your fridge - grocy is a web-based self-hosted groceries + & household management solution for your home + digest: 0d4d35226d2f7d060b6b256bf2e2c7438fd38c14a84d60c1ba27f3b64bf28d45 + home: https://github.com/truecharts/apps/tree/master/charts/stable/grocy + icon: https://truecharts.org/_static/img/appicons/grocy-icon.png + keywords: + - grocy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: grocy + sources: + - https://github.com/grocy/grocy + type: application + urls: + - https://github.com/truecharts/apps/releases/download/grocy-9.0.27/grocy-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -9895,6 +12230,36 @@ entries: - https://github.com/truecharts/apps/releases/download/grocy-9.0.19/grocy-9.0.19.tgz version: 9.0.19 guacd: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.3.0 + created: "2021-12-21T18:45:58.462974785Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Guacd - Apache Guacamole is a clientless remote desktop gateway. + digest: efbafec634971b9855513cbc2baa9408c4723c1c21e96eae6f45464633363933 + home: https://github.com/truecharts/apps/tree/master/charts/stable/guacd + icon: https://truecharts.org/_static/img/appicons/guacd-icon.png + keywords: + - guacd + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: guacd + sources: + - https://hub.docker.com/r/linuxserver/guacd + type: application + urls: + - https://github.com/truecharts/apps/releases/download/guacd-0.0.7/guacd-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10016,6 +12381,37 @@ entries: - https://github.com/truecharts/apps/releases/download/guacd-0.0.1/guacd-0.0.1.tgz version: 0.0.1 habridge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.4.0 + created: "2021-12-21T18:45:58.651827803Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Habridge emulates Philips Hue API to other home automation gateways + such as an Amazon Echo/Dot or other systems that support Philips Hue. + digest: e058207008206392423f7d578abd9672453390bbcbaefae880e3e203c0bdf747 + home: https://github.com/truecharts/apps/tree/master/charts/stable/habridge + icon: https://truecharts.org/_static/img/appicons/habridge-icon.png + keywords: + - habridge + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: habridge + sources: + - https://hub.docker.com/r/linuxserver/habridge + type: application + urls: + - https://github.com/truecharts/apps/releases/download/habridge-0.0.8/habridge-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10172,6 +12568,41 @@ entries: - https://github.com/truecharts/apps/releases/download/habridge-0.0.1/habridge-0.0.1.tgz version: 0.0.1 handbrake: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.24.2 + created: "2021-12-21T18:45:58.799586862Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: HandBrake is a tool for converting video from nearly any format to + a selection of modern, widely supported codecs. + digest: 5cf93a259b668950d74aaed473fc2a7798b43431f4fdb4df5c4f4bcbe1967457 + home: https://github.com/truecharts/apps/tree/master/charts/stable/handbrake + icon: https://truecharts.org/_static/img/appicons/handbrake-icon.png + keywords: + - handbrake + - encode + - media + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: handbrake + sources: + - https://github.com/jlesage/docker-handbrake + - https://hub.docker.com/r/jlesage/handbrake/ + - https://handbrake.fr/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/handbrake-10.0.7/handbrake-10.0.7.tgz + version: 10.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10348,6 +12779,39 @@ entries: - https://github.com/truecharts/apps/releases/download/handbrake-9.0.19/handbrake-9.0.19.tgz version: 9.0.19 haste-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - utilities + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:45:58.956175997Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Simple text sharing + digest: a5ec8e4e63dda459ab44e76e66fac3cd8fcb75dedae2bea4ea5bfe162fa3452a + home: https://github.com/truecharts/apps/tree/master/charts/stable/haste + icon: https://truecharts.org/_static/img/appicons/haste-server-icon.png + keywords: + - haste + - hastebin + - haste-server + - pastebin + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: haste-server + sources: + - https://github.com/seejohnrun/haste-server + - https://github.com/k8s-at-home/container-images + urls: + - https://github.com/truecharts/apps/releases/download/haste-server-4.0.26/haste-server-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10448,6 +12912,40 @@ entries: - https://github.com/truecharts/apps/releases/download/haste-server-4.0.21/haste-server-4.0.21.tgz version: 4.0.21 headphones: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 58edc604 + created: "2021-12-21T18:45:59.101487218Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An automated music downloader for NZB and Torrent, written in Python. + It supports SABnzbd, NZBget, Transmission, µTorrent and Blackhole. + digest: c7a72c5838050ee62d71135e8370d78e9fe31a48d62ac5e994c0e922ea568597 + home: https://github.com/truecharts/apps/tree/master/charts/stable/headphones + icon: https://truecharts.org/_static/img/appicons/headphones-icon.png + keywords: + - headphones + - music + - downloader + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: headphones + sources: + - https://github.com/linuxserver/docker-headphones + - https://github.com/rembo10/headphones + type: application + urls: + - https://github.com/truecharts/apps/releases/download/headphones-2.0.26/headphones-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10551,6 +13049,40 @@ entries: - https://github.com/truecharts/apps/releases/download/headphones-2.0.21/headphones-2.0.21.tgz version: 2.0.21 healthchecks: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.22.0 + created: "2021-12-21T18:45:59.252573093Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Healthchecks is a cron job monitoring service. It listens for HTTP + requests and email messages ("pings") from your cron jobs and scheduled tasks + ("checks"). When a ping does not arrive on time, Healthchecks sends out alerts. + digest: adc958971b2fb06390aeaab45d498ec96698700590a34e5ad3a1bc672f70c70b + home: https://github.com/truechartsapps/tree/master/charts/stable/healthchecks + icon: https://truecharts.org/_static/img/appicons/healthchecks-icon.png + keywords: + - cron + - monitoring + - alert + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: healthchecks + sources: + - https://github.com/healthchecks/healthchecks + - https://hub.docker.com/r/linuxserver/healthchecks + urls: + - https://github.com/truecharts/apps/releases/download/healthchecks-5.0.7/healthchecks-5.0.7.tgz + version: 5.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10688,6 +13220,40 @@ entries: - https://github.com/truecharts/apps/releases/download/healthchecks-5.0.0/healthchecks-5.0.0.tgz version: 5.0.0 hedgedoc: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.9.2 + created: "2021-12-21T18:45:59.405567419Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: HedgeDoc lets you create real-time collaborative markdown notes. + digest: 798d3d7432d62aa1fe149e4a21d3faba9acb61a5ec4b9457ba92ab1362540eba + home: https://github.com/truecharts/apps/tree/master/charts/stable/hedgedoc + icon: https://truecharts.org/_static/img/appicons/hedgedoc-icon.png + keywords: + - hedgedoc + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: hedgedoc + sources: + - https://hub.docker.com/r/linuxserver/hedgedoc + type: application + urls: + - https://github.com/truecharts/apps/releases/download/hedgedoc-0.0.7/hedgedoc-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10825,6 +13391,36 @@ entries: - https://github.com/truecharts/apps/releases/download/hedgedoc-0.0.1/hedgedoc-0.0.1.tgz version: 0.0.1 heimdall: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - organizers + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.2.2 + created: "2021-12-21T18:45:59.549323879Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An Application dashboard and launcher + digest: 1d44f60bb5ee27f5e4a2f0397bd20b045d7146d62e3b70cbd3ead5aefb0c0228 + home: https://github.com/truecharts/apps/tree/master/charts/stable/heimdall + icon: https://truecharts.org/_static/img/appicons/heimdall-icon.png + keywords: + - heimdall + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: heimdall + sources: + - https://github.com/linuxserver/Heimdall/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/heimdall-9.0.31/heimdall-9.0.31.tgz + version: 9.0.31 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -10916,6 +13512,43 @@ entries: - https://github.com/truecharts/apps/releases/download/heimdall-9.0.26/heimdall-9.0.26.tgz version: 9.0.26 home-assistant: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - home-automation + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.12.3 + created: "2021-12-21T18:45:59.712936037Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: home-assistant App for TrueNAS SCALE + digest: 35fdaa360cedc8b7e5721442933383251c9857a64faac8f91948fc542abd3923 + home: https://github.com/truecharts/apps/tree/master/charts/stable/home-assistant + icon: https://truecharts.org/_static/img/appicons/home-assistant-icon.png + keywords: + - home-assistant + - hass + - homeassistant + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: home-assistant + sources: + - https://github.com/home-assistant/home-assistant + - https://github.com/cdr/code-server + type: application + urls: + - https://github.com/truecharts/apps/releases/download/home-assistant-12.0.22/home-assistant-12.0.22.tgz + version: 12.0.22 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11176,6 +13809,36 @@ entries: - https://github.com/truecharts/apps/releases/download/home-assistant-12.0.12/home-assistant-12.0.12.tgz version: 12.0.12 htpcmanager: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.17 + created: "2021-12-21T18:45:59.86526788Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Htpcmanager is a front end for many htpc related applications. + digest: dec5270a37b29c1f09ef3f5c0e06b30c7d003df38ce0f3059dec079da6ee48e7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/htpcmanager + icon: https://truecharts.org/_static/img/appicons/htpcmanager-icon.png + keywords: + - htpcmanager + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: htpcmanager + sources: + - https://hub.docker.com/r/linuxserver/htpcmanager + type: application + urls: + - https://github.com/truecharts/apps/releases/download/htpcmanager-0.0.7/htpcmanager-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11297,6 +13960,37 @@ entries: - https://github.com/truecharts/apps/releases/download/htpcmanager-0.0.1/htpcmanager-0.0.1.tgz version: 0.0.1 hyperion-ng: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.12 + created: "2021-12-21T18:46:00.016486751Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Hyperion is an opensource Bias or Ambient Lighting implementation + digest: 3d32062d521199af407b6622ec8fb051691488db78bc48b5f2d5b65e9417f04c + home: https://github.com/truechartsapps/tree/master/charts/stable/hyperion-ng + icon: https://truecharts.org/_static/img/appicons/hyperion-ng-icon.png + keywords: + - hyperion-ng + - hyperion + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: hyperion-ng + sources: + - https://github.com/hyperion-project/hyperion.ng + - https://hub.docker.com/r/sirfragalot/hyperion.ng + urls: + - https://github.com/truecharts/apps/releases/download/hyperion-ng-4.0.29/hyperion-ng-4.0.29.tgz + version: 4.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11422,6 +14116,39 @@ entries: - https://github.com/truecharts/apps/releases/download/hyperion-ng-4.0.22/hyperion-ng-4.0.22.tgz version: 4.0.22 icantbelieveitsnotvaletudo: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.2.1 + created: "2021-12-21T18:46:00.176997387Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Create live map data from Valetudo powered robots + digest: 0e3d58270053b61e92ab9670657f4400e1811f0d66e8358c07f8427414800a50 + home: https://github.com/truecharts/apps/tree/master/charts/stable/icantbelieveitsnotvaletudo + icon: https://truecharts.org/_static/img/appicons/icantbelieveitsnotvaletudo-icon.png + keywords: + - icantbelieveitsnotvaletudo + - MQTT + - valetudo + - iot + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: icantbelieveitsnotvaletudo + sources: + - https://github.com/Hypfer/ICantBelieveItsNotValetudo + - https://github.com/truecharts/apps/tree/master/charts/icantbelieveitsnotvaletudo + urls: + - https://github.com/truecharts/apps/releases/download/icantbelieveitsnotvaletudo-2.0.26/icantbelieveitsnotvaletudo-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11522,6 +14249,42 @@ entries: - https://github.com/truecharts/apps/releases/download/icantbelieveitsnotvaletudo-2.0.21/icantbelieveitsnotvaletudo-2.0.21.tgz version: 2.0.21 icinga2: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - monitoring + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.13.1 + created: "2021-12-21T18:46:00.355250974Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: A monitoring system which checks the availability of your network + resources, notifies users of outages, and generates performance data for reporting. + digest: 738c307902edc9444d9862e1b2e22f1cf62d1591f389170d8670db3536c686b7 + home: https://github.com/truechartsapps/tree/master/charts/stable/icinga2 + icon: https://truecharts.org/_static/img/appicons/icinga2-icon.png + keywords: + - icinga2 + - monitoring + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: icinga2 + sources: + - https://github.com/jjethwa/icinga2 + - https://icinga.com/ + urls: + - https://github.com/truecharts/apps/releases/download/icinga2-0.0.15/icinga2-0.0.15.tgz + version: 0.0.15 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11631,6 +14394,37 @@ entries: - https://github.com/truecharts/apps/releases/download/icinga2-0.0.10/icinga2-0.0.10.tgz version: 0.0.10 ipfs: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.13.0 + created: "2021-12-21T18:46:00.507729713Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Ipfs - A peer-to-peer hypermedia protocol designed to make the web + faster, safer, and more open + digest: a37e4c5fba10492e6ed15bcec56ea52c522c8ba21bed927786e42970762f3e0f + home: https://github.com/truecharts/apps/tree/master/charts/stable/ipfs + icon: https://truecharts.org/_static/img/appicons/ipfs-icon.png + keywords: + - ipfs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ipfs + sources: + - https://hub.docker.com/r/linuxserver/ipfs + type: application + urls: + - https://github.com/truecharts/apps/releases/download/ipfs-0.0.8/ipfs-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -11787,6 +14581,39 @@ entries: - https://github.com/truecharts/apps/releases/download/ipfs-0.0.1/ipfs-0.0.1.tgz version: 0.0.1 jackett: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + - test + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.20.184 + created: "2021-12-21T18:46:00.674696086Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: API Support for your favorite torrent trackers. + digest: 0767888af4704969341ecbecb41dd6771459248590c2f39bcb8f39ebed7bb36b + home: https://github.com/truecharts/apps/tree/master/charts/stable/jackett + icon: https://truecharts.org/_static/img/appicons/jackett-icon.png + keywords: + - jackett + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: jackett + sources: + - https://github.com/Jackett/Jackett + type: application + urls: + - https://github.com/truecharts/apps/releases/download/jackett-9.0.54/jackett-9.0.54.tgz + version: 9.0.54 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12118,6 +14945,41 @@ entries: - https://github.com/truecharts/apps/releases/download/jackett-9.0.39/jackett-9.0.39.tgz version: 9.0.39 jdownloader2: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - downloads + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.7.1 + created: "2021-12-21T18:46:00.835451415Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: JDownloader is a free, open-source download management tool with + a huge community of developers that makes downloading as easy and fast as it + should be. + digest: ebf30a6a7a25d0ccd0ecc59118f0300f0aa8889160fa6156affa6759919d7de0 + home: https://github.com/truecharts/apps/tree/master/charts/stable/jdownloader2 + icon: https://truecharts.org/_static/img/appicons/jdownloader2-icon.png + keywords: + - jdownloader + - download + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: jdownloader2 + sources: + - https://github.com/jlesage/docker-jdownloader-2 + - https://hub.docker.com/r/jlesage/jdownloader-2 + - https://jdownloader.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/jdownloader2-5.0.7/jdownloader2-5.0.7.tgz + version: 5.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12294,6 +15156,38 @@ entries: - https://github.com/truecharts/apps/releases/download/jdownloader2-4.0.21/jdownloader2-4.0.21.tgz version: 4.0.21 jellyfin: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 10.7.7 + created: "2021-12-21T18:46:01.005629907Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Jellyfin is a Free Software Media System + digest: 5f0e2a07cf8d3202f0e0185c8d14159c2fa334e9f56e5ec3b05f6ff76b08bef2 + home: https://github.com/truecharts/apps/tree/master/charts/stable/jellyfin + icon: https://truecharts.org/_static/img/appicons/jellyfin-icon.png + keywords: + - jellyfin + - plex + - emby + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: jellyfin + sources: + - https://github.com/jellyfin/jellyfin + type: application + urls: + - https://github.com/truecharts/apps/releases/download/jellyfin-9.0.27/jellyfin-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12423,6 +15317,42 @@ entries: - https://github.com/truecharts/apps/releases/download/jellyfin-9.0.20/jellyfin-9.0.20.tgz version: 9.0.20 joplin-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.5.1 + created: "2021-12-21T18:46:01.34002944Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: This server allows you to sync any Joplin client + digest: 86c06fe8a88312d57ea2fbadbb51ef62a620fddae9e49e3dc46e25cd2c6c4043 + home: https://github.com/truecharts/apps/tree/master/charts/stable/jopplin-server + icon: https://truecharts.org/_static/img/appicons/joplin-server-icon.png + keywords: + - joplin + - notes + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: joplin-server + sources: + - https://github.com/laurent22/joplin/tree/dev/packages/server + - https://github.com/laurent22/joplin + - https://hub.docker.com/r/joplin/server + urls: + - https://github.com/truecharts/apps/releases/download/joplin-server-5.0.17/joplin-server-5.0.17.tgz + version: 5.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12532,6 +15462,37 @@ entries: - https://github.com/truecharts/apps/releases/download/joplin-server-5.0.12/joplin-server-5.0.12.tgz version: 5.0.12 k8s-gateway: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - networking + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.1.8 + created: "2021-12-21T18:46:01.732090913Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A Helm chart for the k8s_gateway CoreDNS plugin + digest: 2f5731aac79ff96b8416f2eeb472c79fde71cca44c14d7b294e10775f56c6325 + home: https://github.com/truecharts/apps/tree/master/charts/stable/k8s-gateway + icon: https://truecharts.org/_static/img/appicons/k8s-gateway-icon.png + keywords: + - DNS + - networking + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: k8s-gateway + sources: + - https://github.com/ori-edge/k8s_gateway + type: application + urls: + - https://github.com/truecharts/apps/releases/download/k8s-gateway-4.0.26/k8s-gateway-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12626,6 +15587,40 @@ entries: - https://github.com/truecharts/apps/releases/download/k8s-gateway-4.0.22/k8s-gateway-4.0.22.tgz version: 4.0.22 kanboard: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.2.21 + created: "2021-12-21T18:46:02.047828819Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Kanboard is a free and open source Kanban project management software. + digest: 56b519e0e96bbd476accb2765521d94eae2c358c2a445bd467703dd947c48639 + home: https://github.com/truecharts/apps/tree/master/charts/stable/kanboard + icon: https://truecharts.org/_static/img/appicons/kanboard-icon.png + keywords: + - kanboard + - kanban + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: kanboard + sources: + - https://github.com/kanboard/kanboard + urls: + - https://github.com/truecharts/apps/releases/download/kanboard-5.0.18/kanboard-5.0.18.tgz + version: 5.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12763,6 +15758,36 @@ entries: - https://github.com/truecharts/apps/releases/download/kanboard-5.0.12/kanboard-5.0.12.tgz version: 5.0.12 kms: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - graywares + truecharts.org/grade: U + apiVersion: v2 + appVersion: minimal + created: "2021-12-21T18:46:02.347540031Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Private Windows Activation Server for development and testing + digest: de7b574d8031c165237e52f4fa5f4add533a9b3ac8569767a178225eaf42f4f9 + home: https://github.com/truecharts/apps/tree/master/charts/stable/kms + icon: https://truecharts.org/_static/img/appicons/kms-icon.png + keywords: + - kms + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: kms + sources: + - https://github.com/SystemRage/py-kms + type: application + urls: + - https://github.com/truecharts/apps/releases/download/kms-9.0.31/kms-9.0.31.tgz + version: 9.0.31 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -12914,6 +15939,36 @@ entries: - https://github.com/truecharts/apps/releases/download/kms-9.0.22/kms-9.0.22.tgz version: 9.0.22 kodi-headless: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: "190" + created: "2021-12-21T18:46:02.76205742Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A headless install of kodi in a docker container. + digest: 8a3fccec5ccecd6a336af3d8192844f2dec9f3ea2ff44b9b45f725d07ddd3de3 + home: https://github.com/truecharts/apps/tree/master/charts/stable/kodi-headless + icon: https://truecharts.org/_static/img/appicons/kodi-headless-icon.png + keywords: + - kodi-headless + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: kodi-headless + sources: + - https://hub.docker.com/r/linuxserver/kodi-headless + type: application + urls: + - https://github.com/truecharts/apps/releases/download/kodi-headless-0.0.8/kodi-headless-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13065,6 +16120,39 @@ entries: - https://github.com/truecharts/apps/releases/download/kodi-headless-0.0.1/kodi-headless-0.0.1.tgz version: 0.0.1 komga: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.135.1 + created: "2021-12-21T18:46:02.975554186Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A comics/mangas server to serve/stream pages via API + digest: 4faac3deb5dc52c779d8f036d7d834e78460e31d93ca113cb258f55b1c001d2c + home: https://github.com/truechartsapps/tree/master/charts/stable/komga + icon: https://truecharts.org/_static/img/appicons/komga-icon.png + keywords: + - komga + - comics + - mangas + - server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: komga + sources: + - https://komga.org/ + - https://github.com/gotson/komga + urls: + - https://github.com/truecharts/apps/releases/download/komga-4.0.34/komga-4.0.34.tgz + version: 4.0.34 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13264,6 +16352,38 @@ entries: - https://github.com/truecharts/apps/releases/download/komga-4.0.24/komga-4.0.24.tgz version: 4.0.24 lazylibrarian: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:03.171778572Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Get all your books, like series with Sonarr... + digest: ab5edde713939545c3e21a194b37bfd125e118581f0f40f19c4b79748bcfcda9 + home: https://github.com/truecharts/apps/tree/master/charts/stable/lazylibrarian + icon: https://truecharts.org/_static/img/appicons/lazylibrarian-icon.png + keywords: + - lazylibrarian + - ebooks + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: lazylibrarian + sources: + - https://gitlab.com/LazyLibrarian/LazyLibrarian.git + - https://lazylibrarian.gitlab.io + type: application + urls: + - https://github.com/truecharts/apps/releases/download/lazylibrarian-9.0.35/lazylibrarian-9.0.35.tgz + version: 9.0.35 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13489,6 +16609,40 @@ entries: - https://github.com/truecharts/apps/releases/download/lazylibrarian-9.0.24/lazylibrarian-9.0.24.tgz version: 9.0.24 leaf2mqtt: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "0.5" + created: "2021-12-21T18:46:03.343164637Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Nissan Leaf connected services to MQTT adapter + digest: ef9384515d2cf6175c894f985d6c5bf84b92f974f84a915bf9987f6615c4ce1b + home: https://github.com/truecharts/apps/tree/master/charts/stable/leaf2mqtt + icon: https://truecharts.org/_static/img/appicons/leaf2mqtt-icon.png + keywords: + - leaf2mqtt + - leaf + - nissan + - kamereon + - carwings + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: leaf2mqtt + sources: + - https://github.com/mitsumaui/leaf2mqtt + - https://github.com/k8s-at-home/container-images + urls: + - https://github.com/truecharts/apps/releases/download/leaf2mqtt-2.0.26/leaf2mqtt-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13592,6 +16746,43 @@ entries: - https://github.com/truecharts/apps/releases/download/leaf2mqtt-2.0.21/leaf2mqtt-2.0.21.tgz version: 2.0.21 leantime: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - management + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.8 + created: "2021-12-21T18:46:03.511092966Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: Straightforward open source project management system to make your + ideas reality. + digest: 387553b47d7f64d07dcf858e644ea7fe7d17decec07830a4c93cb03236bc249c + home: https://github.com/truechartsapps/tree/master/charts/stable/leantime + icon: https://truecharts.org/_static/img/appicons/leantime-icon.png + keywords: + - leantime + - project + - management + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: leantime + sources: + - https://leantime.io/ + - https://hub.docker.com/r/nicholaswilde/leantime + urls: + - https://github.com/truecharts/apps/releases/download/leantime-1.0.4/leantime-1.0.4.tgz + version: 1.0.4 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13778,6 +16969,37 @@ entries: - https://github.com/truecharts/apps/releases/download/leantime-0.0.10/leantime-0.0.10.tgz version: 0.0.10 libreoffice: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.4.6 + created: "2021-12-21T18:46:03.691001126Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: LibreOffice is a free and powerful office suite, and a successor + to OpenOffice.org. + digest: 50c6a7af35980f692f3b90f3f516e8255c79f6dd38ac45ff13c39e37bcedfd54 + home: https://github.com/truecharts/apps/tree/master/charts/stable/libreoffice + icon: https://truecharts.org/_static/img/appicons/libreoffice-icon.png + keywords: + - libreoffice + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: libreoffice + sources: + - https://hub.docker.com/r/linuxserver/libreoffice + type: application + urls: + - https://github.com/truecharts/apps/releases/download/libreoffice-0.0.7/libreoffice-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -13903,6 +17125,38 @@ entries: - https://github.com/truecharts/apps/releases/download/libreoffice-0.0.1/libreoffice-0.0.1.tgz version: 0.0.1 librespeed: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.2.4 + created: "2021-12-21T18:46:03.848827935Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Librespeed is a HTML5 webpage to test upload and download speeds + digest: 25d894eef13b4bbb23fc82a7e02247bc73d24fdb2adf45845e5c0d99a460f6b4 + home: https://github.com/truechartsapps/tree/master/charts/stable/librespeed + icon: https://truecharts.org/_static/img/appicons/librespeed-icon.png + keywords: + - librespeed + - speedtest + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: librespeed + sources: + - https://github.com/librespeed/speedtest + - https://hub.docker.com/r/linuxserver/librespeed + - https://github.com/truechartsapps/tree/master/charts/librespeed + urls: + - https://github.com/truecharts/apps/releases/download/librespeed-4.0.30/librespeed-4.0.30.tgz + version: 4.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -14000,6 +17254,38 @@ entries: - https://github.com/truecharts/apps/releases/download/librespeed-4.0.25/librespeed-4.0.25.tgz version: 4.0.25 lidarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.0.2385 + created: "2021-12-21T18:46:04.0138937Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Looks and smells like Sonarr but made for music + digest: 0656b7c5b5ca189ee9403f1179e92d7dd4b2dbe0e86e6bc1b7b05898f9d18772 + home: https://github.com/truecharts/apps/tree/master/charts/stable/lidarr + icon: https://truecharts.org/_static/img/appicons/lidarr-icon.png + keywords: + - lidarr + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: lidarr + sources: + - https://github.com/Lidarr/Lidarr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/lidarr-9.0.29/lidarr-9.0.29.tgz + version: 9.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -14129,6 +17415,37 @@ entries: - https://github.com/truecharts/apps/releases/download/lidarr-9.0.21/lidarr-9.0.21.tgz version: 9.0.21 littlelink: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - social + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:04.196007555Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Easy platform to combine all your social links + digest: 56cd4af88e27b32acd0bb03bbf957c8c2475de6c2b389c5f2e6ce288e6452d21 + home: https://github.com/truecharts/apps/tree/master/charts/stable/littlelink + icon: https://truecharts.org/_static/img/appicons/littlelink-icon.png + keywords: + - littlelink + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: littlelink + sources: + - https://github.com/techno-tim/littlelink-server + - https://github.com/sethcottle/littlelink + type: application + urls: + - https://github.com/truecharts/apps/releases/download/littlelink-4.0.40/littlelink-4.0.40.tgz + version: 4.0.40 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -14409,6 +17726,41 @@ entries: - https://github.com/truecharts/apps/releases/download/littlelink-4.0.27/littlelink-4.0.27.tgz version: 4.0.27 logitech-media-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + - audio + truecharts.org/grade: U + apiVersion: v2 + appVersion: 8.3.0 + created: "2021-12-21T18:46:04.359780882Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Logitech Media Server is a platform for home/office audio streaming. + digest: 14f54ad53df814e2e0fc33586dc61d546a376bcddfc3e816ba20fc50c6b52f15 + home: https://github.com/truecharts/apps/master/charts/incubator/logitech-media-server + icon: https://truecharts.org/_static/img/appicons/logitech-media-server-icon.png + keywords: + - logitech-media-server + - squeezebox + - audio + - streaming + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: logitech-media-server + sources: + - https://github.com/Logitech/slimserver + - https://hub.docker.com/r/lmscommunity/logitechmediaserver + type: application + urls: + - https://github.com/truecharts/apps/releases/download/logitech-media-server-2.0.37/logitech-media-server-2.0.37.tgz + version: 2.0.37 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -14585,6 +17937,40 @@ entries: - https://github.com/truecharts/apps/releases/download/logitech-media-server-2.0.29/logitech-media-server-2.0.29.tgz version: 2.0.29 loki: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - logs + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.4.1 + created: "2021-12-21T18:46:04.535628135Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: promtail.enabled + name: promtail + repository: https://truecharts.org + version: 1.0.17 + description: 'Loki: like Prometheus, but for logs.' + digest: add6e143b50ecc30d7d730519ab9ad060f736433326bb84d03aa02d86d4695ad + home: https://github.com/truecharts/apps/tree/master/charts/stable/loki + icon: https://truecharts.org/_static/img/appicons/loki-icon.png + keywords: + - logs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: loki + sources: + - https://github.com/grafana/loki + type: application + urls: + - https://github.com/truecharts/apps/releases/download/loki-2.0.14/loki-2.0.14.tgz + version: 2.0.14 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -14688,6 +18074,40 @@ entries: - https://github.com/truecharts/apps/releases/download/loki-2.0.9/loki-2.0.9.tgz version: 2.0.9 lychee: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.3.6 + created: "2021-12-21T18:46:04.701306471Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Lychee is a free photo-management tool, which runs on your server + or web-space + digest: 5d51804bfd4be7ece3ae05f7bd710a71e3f1e2d1e3926fd13f5dbaab0e18c22a + home: https://github.com/truecharts/apps/tree/master/charts/stable/lychee + icon: https://truecharts.org/_static/img/appicons/lychee-icon.png + keywords: + - lychee + - photo + - pictures + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: lychee + sources: + - https://github.com/LycheeOrg/Lychee + - https://hub.docker.com/r/lycheeorg/lychee + type: application + urls: + - https://github.com/truecharts/apps/releases/download/lychee-9.0.27/lychee-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -15366,6 +18786,40 @@ entries: - https://github.com/truecharts/apps/releases/download/mariadb-1.0.25/mariadb-1.0.25.tgz version: 1.0.25 mealie: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - utilities + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.5.4 + created: "2021-12-21T18:46:04.876464756Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Mealie is a self hosted recipe manager and meal planner with a RestAPI + backend + digest: 22ba5d214a077b0c6e1c87ca998e146cb0ca5aa89c295bb22ff280e05835f6ae + home: https://github.com/truecharts/apps/tree/master/charts/stable/mealie + icon: https://truecharts.org/_static/img/appicons/mealie-icon.png + keywords: + - grocy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: mealie + sources: + - https://github.com/hay-kot/mealie + urls: + - https://github.com/truecharts/apps/releases/download/mealie-5.0.8/mealie-5.0.8.tgz + version: 5.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -15537,6 +18991,42 @@ entries: - https://github.com/truecharts/apps/releases/download/mealie-5.0.0/mealie-5.0.0.tgz version: 5.0.0 medusa: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.5.20 + created: "2021-12-21T18:46:05.07653636Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An automatic Video Library Manager for TV Shows + digest: 5814926f35c6018ab0b8fd8df3996081097c77906877c9f20403abb0557ab593 + home: https://github.com/truecharts/apps/tree/master/charts/stable/medusa + icon: https://truecharts.org/_static/img/appicons/medusa-icon.png + keywords: + - medusa + - video + - library + - manager + - tv + - shows + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: medusa + sources: + - https://github.com/linuxserver/docker-medusa + - https://pymedusa.com/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/medusa-1.0.30/medusa-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16260,6 +19750,37 @@ entries: - https://github.com/truecharts/apps/releases/download/metallb-1.0.2/metallb-1.0.2.tgz version: 1.0.2 minetest: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.4.1 + created: "2021-12-21T18:46:05.284692179Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Minetest (server) is a near-infinite-world block sandbox game and + a game engine. + digest: ed313a0da9d5edf0fa4ea9956bc4036449ee1b905405d29ee63dc4889ad4683c + home: https://github.com/truecharts/apps/tree/master/charts/stable/minetest + icon: https://truecharts.org/_static/img/appicons/minetest-icon.png + keywords: + - minetest + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: minetest + sources: + - https://hub.docker.com/r/linuxserver/minetest + type: application + urls: + - https://github.com/truecharts/apps/releases/download/minetest-0.0.7/minetest-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16385,6 +19906,41 @@ entries: - https://github.com/truecharts/apps/releases/download/minetest-0.0.1/minetest-0.0.1.tgz version: 0.0.1 miniflux: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.34 + created: "2021-12-21T18:46:05.466603645Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Miniflux is a minimalist and opinionated feed reader. + digest: 4079987e22cf48a0336dd603bd34aa56d89a7b07c537720cfee57ee6e3215987 + home: https://github.com/truecharts/apps/tree/master/charts/miniflux + icon: https://truecharts.org/_static/img/appicons/miniflux-icon.png + keywords: + - miniflux + - rss + - news + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: miniflux + sources: + - https://github.com/miniflux/v2 + urls: + - https://github.com/truecharts/apps/releases/download/miniflux-4.0.18/miniflux-4.0.18.tgz + version: 4.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16526,6 +20082,37 @@ entries: - https://github.com/truecharts/apps/releases/download/miniflux-4.0.12/miniflux-4.0.12.tgz version: 4.0.12 minio: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:05.639852265Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Minio is a self-hosted S3 storage server + digest: 98e1c5c2dbfa6c3e775e3b87ba4d97de30c2f05bef57b87272deea12c7b622c9 + home: https://github.com/truecharts/apps/tree/master/charts/stable/minio + icon: https://truecharts.org/_static/img/appicons/minio-icon.png + keywords: + - minio + - s3 + - storage + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: minio + sources: + - https://github.com/minio/minio + urls: + - https://github.com/truecharts/apps/releases/download/minio-1.0.14/minio-1.0.14.tgz + version: 1.0.14 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16620,6 +20207,37 @@ entries: - https://github.com/truecharts/apps/releases/download/minio-1.0.9/minio-1.0.9.tgz version: 1.0.9 minio-console: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.12.9 + created: "2021-12-21T18:46:05.784233029Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A management console for minio server and operator + digest: 5a08c3305ba572be59bc4b9239a807685c5a1299255cbf7ad6ecd10eae40f349 + home: https://github.com/truecharts/apps/tree/master/charts/stable/minio-console + icon: https://truecharts.org/_static/img/appicons/minio-console-icon.png + keywords: + - minio-console + - minio + - s3 + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: minio-console + sources: + - https://github.com/minio/console + urls: + - https://github.com/truecharts/apps/releases/download/minio-console-1.0.32/minio-console-1.0.32.tgz + version: 1.0.32 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16745,6 +20363,37 @@ entries: - https://github.com/truecharts/apps/releases/download/minio-console-1.0.24/minio-console-1.0.24.tgz version: 1.0.24 minisatip: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.12.01 + created: "2021-12-21T18:46:05.934036252Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Minisatip is a multi-threaded satip server version 1.2 that runs + under Linux. + digest: b46f56ee6aed32b2e5a4116fae9bc05622984d72064699ce6241419bbbfd78ba + home: https://github.com/truecharts/apps/tree/master/charts/stable/minisatip + icon: https://truecharts.org/_static/img/appicons/minisatip-icon.png + keywords: + - minisatip + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: minisatip + sources: + - https://hub.docker.com/r/linuxserver/minisatip + type: application + urls: + - https://github.com/truecharts/apps/releases/download/minisatip-0.0.8/minisatip-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -16901,6 +20550,41 @@ entries: - https://github.com/truecharts/apps/releases/download/minisatip-0.0.1/minisatip-0.0.1.tgz version: 0.0.1 monica: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - crm + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.5.0 + created: "2021-12-21T18:46:06.101261724Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: Straightforward open source project management system to make your + ideas reality. + digest: 2a743b05c2d496e935b54c37e99b305b435c1c9390de84fa745f1937804c4bb5 + home: https://github.com/truechartsapps/tree/master/charts/stable/monica + icon: https://truecharts.org/_static/img/appicons/monica-icon.png + keywords: + - crm + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: monica + sources: + - https://github.com/monicahq/monica + - https://hub.docker.com/_/monica + urls: + - https://github.com/truecharts/apps/releases/download/monica-0.0.18/monica-0.0.18.tgz + version: 0.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17042,6 +20726,38 @@ entries: - https://github.com/truecharts/apps/releases/download/monica-0.0.12/monica-0.0.12.tgz version: 0.0.12 mosquitto: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - homeautomation + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.14 + created: "2021-12-21T18:46:06.273271573Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Eclipse Mosquitto - An open source MQTT broker + digest: f2bb61ba14b064d6b213b90c654a1c447f5f96a8713be6f7613deb0e1ee8736b + home: https://github.com/truecharts/apps/tree/master/charts/stable/mosquitto + icon: https://truecharts.org/_static/img/appicons/mosquitto-icon.png + keywords: + - mosquitto + - MQTT + - eclipse-iot + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: mosquitto + sources: + - https://github.com/eclipse/mosquitto + type: application + urls: + - https://github.com/truecharts/apps/releases/download/mosquitto-4.0.28/mosquitto-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17139,6 +20855,39 @@ entries: - https://github.com/truecharts/apps/releases/download/mosquitto-4.0.23/mosquitto-4.0.23.tgz version: 4.0.23 mstream: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.2.5 + created: "2021-12-21T18:46:06.41171759Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A personal music streaming server + digest: 0a144bb125f6d1bd05686716fb8c71f11b1afb5b841bcafb76b6c9ab3caa4f05 + home: https://github.com/truecharts/apps/tree/master/charts/stable/mstream + icon: https://truecharts.org/_static/img/appicons/mstream-icon.png + keywords: + - mstream + - server + - music + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: mstream + sources: + - https://github.com/linuxserver/docker-mstream + - https://mstream.io/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/mstream-1.0.26/mstream-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17239,6 +20988,41 @@ entries: - https://github.com/truecharts/apps/releases/download/mstream-1.0.21/mstream-1.0.21.tgz version: 1.0.21 muximux: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "057352e8" + created: "2021-12-21T18:46:06.56821674Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A lightweight portal to view & manage your HTPC apps without having + to run anything more than a PHP enabled webserver + digest: 941bc66bfb221a84e190506ae497b395a85c151dfb7da02a576f08957b7b1d68 + home: https://github.com/truecharts/apps/tree/master/charts/stable/muximux + icon: https://truecharts.org/_static/img/appicons/muximux-icon.png + keywords: + - muximux + - htpc + - manage + - portal + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: muximux + sources: + - https://github.com/linuxserver/docker-muximux + - https://github.com/mescon/Muximux + type: application + urls: + - https://github.com/truecharts/apps/releases/download/muximux-1.0.30/muximux-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17345,6 +21129,37 @@ entries: - https://github.com/truecharts/apps/releases/download/muximux-1.0.25/muximux-1.0.25.tgz version: 1.0.25 mylar: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.5.3 + created: "2021-12-21T18:46:06.733273469Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Mylar is a automated Comic Book downloader + digest: 847c5d3a3db8f18c1b6d2fb1a37770f9cffba1fbc3827221c655ee05ea863bcb + home: https://github.com/truechartsapps/tree/master/charts/stable/mylar + icon: https://truecharts.org/_static/img/appicons/mylar-icon.png + keywords: + - mylar + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: mylar + sources: + - https://github.com/mylar3/mylar3 + - https://github.com/linuxserver/docker-mylar3 + - https://github.com/truechartsapps/tree/master/charts/mylar + urls: + - https://github.com/truecharts/apps/releases/download/mylar-4.0.26/mylar-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17439,6 +21254,37 @@ entries: - https://github.com/truecharts/apps/releases/download/mylar-4.0.21/mylar-4.0.21.tgz version: 4.0.21 mysql-workbench: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 8.0.27 + created: "2021-12-21T18:46:06.897886109Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: MySQL Workbench is a unified visual tool for database architects, + developers and DBAs. + digest: b0277e127510e5e7ffa5ac06685d2e6bec8cfb2f8054536ad43a6b384840d207 + home: https://github.com/truecharts/apps/tree/master/charts/stable/mysql-workbench + icon: https://truecharts.org/_static/img/appicons/mysql-workbench-icon.png + keywords: + - mysql-workbench + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: mysql-workbench + sources: + - https://hub.docker.com/r/linuxserver/mysql-workbench + type: application + urls: + - https://github.com/truecharts/apps/releases/download/mysql-workbench-0.0.7/mysql-workbench-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17564,6 +21410,37 @@ entries: - https://github.com/truecharts/apps/releases/download/mysql-workbench-0.0.1/mysql-workbench-0.0.1.tgz version: 0.0.1 nano-wallet: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.18 + created: "2021-12-21T18:46:07.057613875Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Nano-wallet is a digital payment protocol designed to be accessible + and lightweight. + digest: cce96f7138314a033e0db314580932430428f14aba658c44969c1cb79b77dec2 + home: https://github.com/truecharts/apps/tree/master/charts/stable/nano-wallet + icon: https://truecharts.org/_static/img/appicons/nano-wallet-icon.png + keywords: + - nano-wallet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: nano-wallet + sources: + - https://hub.docker.com/r/linuxserver/nano-wallet + type: application + urls: + - https://github.com/truecharts/apps/releases/download/nano-wallet-0.0.9/nano-wallet-0.0.9.tgz + version: 0.0.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17689,6 +21566,40 @@ entries: - https://github.com/truecharts/apps/releases/download/nano-wallet-0.0.1/nano-wallet-0.0.1.tgz version: 0.0.1 navidrome: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.47.0 + created: "2021-12-21T18:46:07.208459771Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Navidrome is an open source web-based music collection server and + streamer + digest: faec7c4e94282fd0ab46b6074f7e36abc826d8cad0843e34c112d556709f52b1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/navidrome + icon: https://truecharts.org/_static/img/appicons/navidrome-icon.png + keywords: + - navidrome + - music + - streaming + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: navidrome + sources: + - https://github.com/deluan/navidrome + - https://hub.docker.com/r/deluan/navidrome + type: application + urls: + - https://github.com/truecharts/apps/releases/download/navidrome-9.0.27/navidrome-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -17826,6 +21737,50 @@ entries: - https://github.com/truecharts/apps/releases/download/navidrome-9.0.20/navidrome-9.0.20.tgz version: 9.0.20 nextcloud: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - cloud + truecharts.org/grade: U + apiVersion: v2 + appVersion: 23.0.0 + created: "2021-12-21T18:46:07.388110022Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: A private cloud server that puts the control and security of your + own data back into your hands. + digest: 66e3570e91bce3f8db322bac4063546ca59dbedfb99e333e317f14fe1210306f + home: https://nextcloud.com/ + icon: https://truecharts.org/_static/img/appicons/nextcloud-icon.png + keywords: + - nextcloud + - storage + - http + - web + - php + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: nextcloud + sources: + - https://github.com/nextcloud/docker + - https://github.com/nextcloud/helm + type: application + urls: + - https://github.com/truecharts/apps/releases/download/nextcloud-11.0.8/nextcloud-11.0.8.tgz + version: 11.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18047,6 +22002,37 @@ entries: - https://github.com/truecharts/apps/releases/download/nextcloud-11.0.0/nextcloud-11.0.0.tgz version: 11.0.0 ngircd: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.21 + created: "2021-12-21T18:46:07.515562424Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Ngircd is a free, portable and lightweight Internet Relay Chat server + for small or private networks. + digest: 67fc42fca0fa644ea0a74b56f8a34ed0e496d1a5b057f3c23dd7bd11546d60f6 + home: https://github.com/truecharts/apps/tree/master/charts/stable/ngircd + icon: https://truecharts.org/_static/img/appicons/ngircd-icon.png + keywords: + - ngircd + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ngircd + sources: + - https://hub.docker.com/r/linuxserver/ngircd + type: application + urls: + - https://github.com/truecharts/apps/releases/download/ngircd-0.0.7/ngircd-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18172,6 +22158,37 @@ entries: - https://github.com/truecharts/apps/releases/download/ngircd-0.0.1/ngircd-0.0.1.tgz version: 0.0.1 nntp2nntp: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.3.202111 + created: "2021-12-21T18:46:07.670597712Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Nntp2nntp proxy allow you to use your NNTP Account from multiple + systems, each with own user name and password. + digest: 5efcc8a3cbb3c21b2a135a5fa390a785755af178751b770e3ef364285e07502d + home: https://github.com/truecharts/apps/tree/master/charts/stable/nntp2nntp + icon: https://truecharts.org/_static/img/appicons/nntp2nntp-icon.png + keywords: + - nntp2nntp + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: nntp2nntp + sources: + - https://hub.docker.com/r/linuxserver/nntp2nntp + type: application + urls: + - https://github.com/truecharts/apps/releases/download/nntp2nntp-0.0.7/nntp2nntp-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18297,6 +22314,37 @@ entries: - https://github.com/truecharts/apps/releases/download/nntp2nntp-0.0.1/nntp2nntp-0.0.1.tgz version: 0.0.1 node-red: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - tools + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.4 + created: "2021-12-21T18:46:07.814886378Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Node-RED is low-code programming for event-driven applications + digest: e10d9849624a4622036483b79a7d1a7ac75ecb7cc2c82801b8d54fe5a5dba165 + home: https://github.com/truecharts/apps/tree/master/charts/stable/node-red + icon: https://truecharts.org/_static/img/appicons/node-red-icon.png + keywords: + - node-red + - nodered + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: node-red + sources: + - https://github.com/node-red/node-red-docker + type: application + urls: + - https://github.com/truecharts/apps/releases/download/node-red-9.0.27/node-red-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18422,6 +22470,39 @@ entries: - https://github.com/truecharts/apps/releases/download/node-red-9.0.20/node-red-9.0.20.tgz version: 9.0.20 novnc: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.2.0 + created: "2021-12-21T18:46:07.983633211Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: The open source VNC client + digest: ce46366317e7e2203af72c07e6528a6b30beb8cb7e8d385148d57e9cbaeec4d9 + home: https://github.com/truecharts/apps/tree/master/charts/stable/novnc + icon: https://truecharts.org/_static/img/appicons/novnc-icon.png + keywords: + - novnc + - vnc + - remote + - desktop + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: novnc + sources: + - https://novnc.com/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/novnc-1.0.26/novnc-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18522,6 +22603,35 @@ entries: - https://github.com/truecharts/apps/releases/download/novnc-1.0.21/novnc-1.0.21.tgz version: 1.0.21 nullserv: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.3.0 + created: "2021-12-21T18:46:08.131682079Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A simple null file http and https server + digest: 1624b0ab8a8a653d5054f5a07ccb079f6e41e3978530a5360ea273a08257d4d5 + home: https://github.com/truechartsapps/tree/master/charts/stable/nullserv + icon: https://truecharts.org/_static/img/appicons/nullserv-icon.png + keywords: + - nullserv + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: nullserv + sources: + - https://github.com/bmrzycki/nullserv + urls: + - https://github.com/truecharts/apps/releases/download/nullserv-4.0.26/nullserv-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18610,6 +22720,37 @@ entries: - https://github.com/truecharts/apps/releases/download/nullserv-4.0.21/nullserv-4.0.21.tgz version: 4.0.21 nzbget: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "21.1" + created: "2021-12-21T18:46:08.288571019Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: NZBGet is a Usenet downloader client + digest: 0fa9360dbebb798977c71a432b16b8656ed6c962362c09acb97d0052b2cecff4 + home: https://github.com/truecharts/apps/tree/master/charts/stable/nzbget + icon: https://truecharts.org/_static/img/appicons/nzbget-icon.png + keywords: + - nzbget + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: nzbget + sources: + - https://nzbget.net/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/nzbget-9.0.27/nzbget-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18704,6 +22845,34 @@ entries: - https://github.com/truecharts/apps/releases/download/nzbget-9.0.22/nzbget-9.0.22.tgz version: 9.0.22 nzbhydra: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.18.4 + created: "2021-12-21T18:46:08.445959046Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + deprecated: true + description: Usenet meta search + digest: efdd9c404281af8d376322d1a85ce7fd64e9fbf1df276f69a8a0a1ebda08b7f5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/nzbhydra + icon: https://truecharts.org/_static/img/appicons/nzbhydra-icon.png + keywords: + - nzbhydra + - usenet + kubeVersion: '>=1.16.0-0' + name: nzbhydra + sources: + - https://github.com/theotherp/nzbhydra2 + type: application + urls: + - https://github.com/truecharts/apps/releases/download/nzbhydra-9.0.30/nzbhydra-9.0.30.tgz + version: 9.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18845,6 +23014,38 @@ entries: - https://github.com/truecharts/apps/releases/download/nzbhydra-9.0.21/nzbhydra-9.0.21.tgz version: 9.0.21 octoprint: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.7.2 + created: "2021-12-21T18:46:08.605717112Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: OctoPrint is the snappy web interface for your 3D printer + digest: a0894a78d50ca9e30de4272083414ae9b0512ebbcf6b54eac49a5c4ffc5a0c65 + home: https://github.com/truechartsapps/tree/master/charts/stable/octoprint + icon: https://truecharts.org/_static/img/appicons/octoprint-icon.png + keywords: + - octoprint + - 3d + - printer + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: octoprint + sources: + - https://github.com/OctoPrint/OctoPrint + - https://hub.docker.com/r/octoprint/octoprint + urls: + - https://github.com/truecharts/apps/releases/download/octoprint-4.0.28/octoprint-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -18974,6 +23175,48 @@ entries: - https://github.com/truecharts/apps/releases/download/octoprint-4.0.21/octoprint-4.0.21.tgz version: 4.0.21 odoo: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "14.0" + created: "2021-12-21T18:46:08.797143158Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: All-in-one business software. Beautiful. Easy-to-use. CRM, Accounting, + PM, HR, Procurement, Point of Sale, MRP, Marketing, etc. + digest: 141c963a1d655d22f6633958b1c57c4d15a815e8ecef74af0ec6043b62187973 + home: https://github.com/truecharts/apps/tree/main/charts/odoo + icon: https://truecharts.org/_static/img/appicons/odoo-icon.png + keywords: + - odoo + - crm + - pm + - hr + - accounting + - mrp + - marketing + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: odoo + sources: + - https://www.odoo.com/ + - https://hub.docker.com/repository/docker/nicholaswilde/odoo + type: application + urls: + - https://github.com/truecharts/apps/releases/download/odoo-4.0.17/odoo-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -19101,6 +23344,36 @@ entries: - https://github.com/truecharts/apps/releases/download/odoo-4.0.12/odoo-4.0.12.tgz version: 4.0.12 omada-controller: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "4.4" + created: "2021-12-21T18:46:08.965468502Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Omada is a SDN tool for TP-Link Omada hardware + digest: 731e1cdb23bf4d48de1885468bc00ad07e863eafa19b17903b27beaf1fa5c369 + home: https://github.com/truechartsapps/tree/master/charts/stable/omada-controller + icon: https://truecharts.org/_static/img/appicons/omada-controller-icon.png + keywords: + - omada-controller + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: omada-controller + sources: + - https://github.com/mbentley/docker-omada-controller + - https://github.com/truechartsapps/tree/master/charts/omada-controller + urls: + - https://github.com/truecharts/apps/releases/download/omada-controller-4.0.37/omada-controller-4.0.37.tgz + version: 4.0.37 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -19312,6 +23585,41 @@ entries: - https://github.com/truecharts/apps/releases/download/omada-controller-4.0.28/omada-controller-4.0.28.tgz version: 4.0.28 ombi: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.7.11 + created: "2021-12-21T18:46:09.118855932Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Want a Movie or TV Show on Plex or Emby? Use Ombi! + digest: 5e3d5b031567642998fc1772595950eb07a33c5926a3236f5d6debe81210072f + home: https://github.com/truecharts/apps/tree/master/charts/stable/ombi + icon: https://truecharts.org/_static/img/appicons/ombi-icon.png + keywords: + - ombi + - plex + - emby + - sonarr + - radarr + - couchpotato + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ombi + sources: + - https://github.com/tidusjar/Ombi + type: application + urls: + - https://github.com/truecharts/apps/releases/download/ombi-9.0.29/ombi-9.0.29.tgz + version: 9.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -19523,6 +23831,42 @@ entries: - https://github.com/truecharts/apps/releases/download/ombi-9.0.20/ombi-9.0.20.tgz version: 9.0.20 onlyoffice-document-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - office + - documents + - productivity + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.4.2.6 + created: "2021-12-21T18:46:09.282676293Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: 'ONLYOFFICE Document Server is an online office suite comprising + viewers and editors for texts, spreadsheets and presentations, fully compatible + with Office Open XML formats: .docx, .xlsx, .pptx and enabling collaborative + editing in real time.' + digest: a35b55c0bf1509793498f0f7abd452c8660e447314dd09fc5ccf0652b8c44474 + home: https://github.com/truecharts/apps/tree/master/charts/stable/onlyoffice-document-server + icon: https://truecharts.org/_static/img/appicons/onlyoffice-document-server-icon.png + keywords: + - onlyoffice + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: onlyoffice-document-server + sources: + - https://github.com/ONLYOFFICE/DocumentServer + - https://github.com/ONLYOFFICE/Docker-DocumentServer + - https://hub.docker.com/r/onlyoffice/documentserver/ + urls: + - https://github.com/truecharts/apps/releases/download/onlyoffice-document-server-3.0.7/onlyoffice-document-server-3.0.7.tgz + version: 3.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -19668,6 +24012,43 @@ entries: - https://github.com/truecharts/apps/releases/download/onlyoffice-document-server-3.0.0/onlyoffice-document-server-3.0.0.tgz version: 3.0.0 openkm: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.3.11 + created: "2021-12-21T18:46:09.462911528Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: OpenKM integrates all essential documents management, collaboration + and an advanced search functionality into one easy to use solution. + digest: 5db92bdfd1767fd0698eddffd720493049241d71b5ccccb26d7c3db0889a9c4a + home: https://github.com/truecharts/apps/tree/master/charts/stable/openkm + icon: https://truecharts.org/_static/img/appicons/openkm-icon.png + keywords: + - openkm + - documentation management + - docs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: openkm + sources: + - https://www.openkm.com/ + - https://github.com/openkm/document-management-system + urls: + - https://github.com/truecharts/apps/releases/download/openkm-4.0.17/openkm-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -19780,6 +24161,40 @@ entries: - https://github.com/truecharts/apps/releases/download/openkm-4.0.12/openkm-4.0.12.tgz version: 4.0.12 openldap: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - cloud + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.5.0 + created: "2021-12-21T18:46:09.615278285Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Community developed LDAP software + digest: cc9970f81307e637d3ad0284723001045aa3e942ef42642ced31062cad5c30d2 + home: https://www.openldap.org + icon: https://truecharts.org/_static/img/appicons/openldap-icon.png + keywords: + - ldap + - openldap + - iam-stack + - high availability + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: openldap + sources: + - https://github.com/jp-gouin/helm-openldap + - https://github.com/osixia/docker-openldap + type: application + urls: + - https://github.com/truecharts/apps/releases/download/openldap-5.0.9/openldap-5.0.9.tgz + version: 5.0.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20019,6 +24434,37 @@ entries: - https://github.com/truecharts/apps/releases/download/openldap-4.0.25/openldap-4.0.25.tgz version: 4.0.25 openvscode-server: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.63.0 + created: "2021-12-21T18:46:09.76464452Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Openvscode-server provides a version of VS Code that runs a server + on a remote machine. + digest: faed0f58ef3f55104a441726cc3040729759bf518ed2f699cfa699c8a346dc91 + home: https://github.com/truecharts/apps/tree/master/charts/stable/openvscode-server + icon: https://truecharts.org/_static/img/appicons/openvscode-server-icon.png + keywords: + - openvscode-server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: openvscode-server + sources: + - https://hub.docker.com/r/linuxserver/openvscode-server + type: application + urls: + - https://github.com/truecharts/apps/releases/download/openvscode-server-0.0.8/openvscode-server-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20175,6 +24621,37 @@ entries: - https://github.com/truecharts/apps/releases/download/openvscode-server-0.0.1/openvscode-server-0.0.1.tgz version: 0.0.1 organizr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - organizers + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:09.919370616Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: HTPC/Homelab Services Organizer + digest: 556cfb27e5b8ea156f2123797c8cfd998231d1710e10476ec1d2083b2a8e4130 + home: https://github.com/truecharts/apps/tree/master/charts/stable/organizr + icon: https://truecharts.org/_static/img/appicons/organizr-icon.png + keywords: + - organizr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: organizr + sources: + - https://github.com/causefx/Organizr + - https://hub.docker.com/r/organizr/organizr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/organizr-9.0.27/organizr-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20269,6 +24746,36 @@ entries: - https://github.com/truecharts/apps/releases/download/organizr-9.0.22/organizr-9.0.22.tgz version: 9.0.22 oscam: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - DIY + truecharts.org/grade: U + apiVersion: v2 + appVersion: "11693" + created: "2021-12-21T18:46:10.07648885Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Open Source Conditional Access Module software + digest: e2be7e65c64c51a02896219cedbc4463da8455e2713efac58a33caf1235bd28e + home: https://github.com/truecharts/apps/tree/master/charts/stable/oscam + icon: https://truecharts.org/_static/img/appicons/oscam-icon.png + keywords: + - oscam + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: oscam + sources: + - https://trac.streamboard.tv/oscam/browser/trunk + type: application + urls: + - https://github.com/truecharts/apps/releases/download/oscam-4.0.26/oscam-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20360,6 +24867,41 @@ entries: - https://github.com/truecharts/apps/releases/download/oscam-4.0.21/oscam-4.0.21.tgz version: 4.0.21 overseerr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.27.0 + created: "2021-12-21T18:46:10.250968034Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Overseerr is a free and open source software application for managing + requests for your media library. It integrates with your existing services such + as Sonarr, Radarr and Plex! + digest: e2e2512ebd8e8f74aa65681233fa09583136c4af5f75b411713c8e1f26516828 + home: https://github.com/truechartsapps/tree/master/charts/stable/overseerr + icon: https://truecharts.org/_static/img/appicons/overseerr-icon.png + keywords: + - overseerr + - plex + - sonarr + - radarr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: overseerr + sources: + - https://github.com/sct/overseerr + - https://hub.docker.com/r/sctx/overseerr + urls: + - https://github.com/truecharts/apps/releases/download/overseerr-4.0.26/overseerr-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20466,6 +25008,40 @@ entries: - https://github.com/truecharts/apps/releases/download/overseerr-4.0.21/overseerr-4.0.21.tgz version: 4.0.21 owncast: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.0.10 + created: "2021-12-21T18:46:10.392636268Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Take control over your live stream video by running it yourself. + Streaming + chat out of the box. + digest: 2c211c545e305f45fc4e0cf0ea3a19af1106a42a641c3ca38249e49b91b8ae65 + home: https://github.com/truechartsapps/tree/master/charts/stable/owncast + icon: https://truecharts.org/_static/img/appicons/owncast-icon.png + keywords: + - owncast + - stream + - open source + - chat + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: owncast + sources: + - https://owncast.online/ + - https://github.com/owncast/owncast + urls: + - https://github.com/truecharts/apps/releases/download/owncast-4.0.26/owncast-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20603,6 +25179,43 @@ entries: - https://github.com/truecharts/apps/releases/download/owncast-4.0.19/owncast-4.0.19.tgz version: 4.0.19 owncloud-ocis: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.15.0 + created: "2021-12-21T18:46:10.542071701Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: ownCloud Infinite Scale is a self-hosted file sync and share server. + digest: 8c56065d67413664749ecdcffe3e454ac35af6c3128e604c1ae968e7cf6edb4f + home: https://github.com/truechartsapps/tree/master/charts/stable/owncloud-ocis + icon: https://truecharts.org/_static/img/appicons/owncloud-ocis-icon.png + keywords: + - owncloud + - ocis + - infinite + - scale + - self-hosted + - sync + - share + - server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: owncloud-ocis + sources: + - https://hub.docker.com/r/owncloud/ocis + - https://owncloud.dev/ocis/ + urls: + - https://github.com/truecharts/apps/releases/download/owncloud-ocis-4.0.28/owncloud-ocis-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20752,6 +25365,45 @@ entries: - https://github.com/truecharts/apps/releases/download/owncloud-ocis-4.0.21/owncloud-ocis-4.0.21.tgz version: 4.0.21 paperless-ng: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.5.0 + created: "2021-12-21T18:46:10.73001944Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: Paperless-ng is an application by Daniel Quinn and contributors that + indexes your scanned documents. + digest: 29091af3f11e1c2f0248ef149568ec1fd68c8a2d3070e34a10420df26e82d286 + home: https://github.com/truecharts/apps/tree/master/charts/stable/paperless-ng + icon: https://truecharts.org/_static/img/appicons/paperless-ng-icon.png + keywords: + - paperless-ng + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: paperless-ng + sources: + - https://hub.docker.com/r/linuxserver/paperless-ng + type: application + urls: + - https://github.com/truecharts/apps/releases/download/paperless-ng-1.0.5/paperless-ng-1.0.5.tgz + version: 1.0.5 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -20994,6 +25646,41 @@ entries: - https://github.com/truecharts/apps/releases/download/paperless-ng-0.0.1/paperless-ng-0.0.1.tgz version: 0.0.1 papermerge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.1 + created: "2021-12-21T18:46:10.884631394Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: redis.enabled + name: redis + repository: https://truecharts.org + version: 1.0.42 + description: Papermerge is an open source document management system (DMS) primarily + designed for archiving and retrieving your digital documents. + digest: f822859a6284561b5adb8043974da74341b21175e3c597301a62770ad631dae7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/papermerge + icon: https://truecharts.org/_static/img/appicons/papermerge-icon.png + keywords: + - papermerge + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: papermerge + sources: + - https://hub.docker.com/r/linuxserver/papermerge + type: application + urls: + - https://github.com/truecharts/apps/releases/download/papermerge-0.0.8/papermerge-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -21158,6 +25845,38 @@ entries: - https://github.com/truecharts/apps/releases/download/papermerge-0.0.1/papermerge-0.0.1.tgz version: 0.0.1 pgadmin: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - management + truecharts.org/grade: U + apiVersion: v2 + appVersion: "6.3" + created: "2021-12-21T18:46:11.046179534Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Web-Based postgresql database management utility + digest: a5891c225082802ef09d47ffdd537aae437918fc1d0d6923dafe8252fb171ebb + home: https://github.com/truecharts/apps/tree/master/charts/stable/pgadmin + icon: https://truecharts.org/_static/img/appicons/pgadmin-icon.png + keywords: + - pgadmin + - db + - database + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pgadmin + sources: + - https://www.pgadmin.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pgadmin-5.0.8/pgadmin-5.0.8.tgz + version: 5.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -21319,6 +26038,44 @@ entries: - https://github.com/truecharts/apps/releases/download/pgadmin-5.0.0/pgadmin-5.0.0.tgz version: 5.0.0 photoprism: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "20211215" + created: "2021-12-21T18:46:11.208821956Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: PhotoPrism® is a server-based application for browsing, organizing + and sharing your personal photo collection + digest: 131242c9e353092d1c4dab0b5f7f4d34093c5b40c6ec943890c17c355eb226ef + home: https://github.com/truechartsapps/tree/master/charts/stable/photoprism + icon: https://truecharts.org/_static/img/appicons/photoprism-icon.png + keywords: + - photos + - photoprism + - pictures + - sharing + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: photoprism + sources: + - https://github.com/photoprism/photoprism + - https://hub.docker.com/r/photoprism/photoprism + urls: + - https://github.com/truecharts/apps/releases/download/photoprism-7.0.9/photoprism-7.0.9.tgz + version: 7.0.9 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -21548,6 +26305,41 @@ entries: - https://github.com/truecharts/apps/releases/download/photoprism-6.0.9/photoprism-6.0.9.tgz version: 6.0.9 photoshow: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 48aabb98 + created: "2021-12-21T18:46:11.367162148Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A gallery software at its easiest, it doesn't even require a database. + digest: aecf7ba76cf08a8fa28cdb6ffdc4567cdc0d9e2fce548550583ab65598d51242 + home: https://github.com/truecharts/apps/tree/master/charts/stable/photoshow + icon: https://truecharts.org/_static/img/appicons/photoshow-icon.png + keywords: + - photoshow + - photo + - show + - gallary + - image + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: photoshow + sources: + - https://github.com/thibaud-rohmer/PhotoShow + - https://github.com/linuxserver/docker-photoshow + type: application + urls: + - https://github.com/truecharts/apps/releases/download/photoshow-1.0.30/photoshow-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -21654,6 +26446,38 @@ entries: - https://github.com/truecharts/apps/releases/download/photoshow-1.0.25/photoshow-1.0.25.tgz version: 1.0.25 phpldapadmin: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - management + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.9.0 + created: "2021-12-21T18:46:11.541375679Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Web-based LDAP browser to manage your LDAP server + digest: f20ead7a326244308b1b450a74e132d15370629add45ceea60716c5417bc0c4b + home: https://github.com/truecharts/apps/tree/master/charts/stable/phpldapadmin + icon: https://truecharts.org/_static/img/appicons/phpldapadmin-icon.png + keywords: + - phpldapadmin + - openldap + - userrights + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: phpldapadmin + sources: + - https://gitlab.v2.rancher.geohub.space/g3s/i3s/i3s-helm-catalog + type: application + urls: + - https://github.com/truecharts/apps/releases/download/phpldapadmin-4.0.27/phpldapadmin-4.0.27.tgz + version: 4.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -21783,6 +26607,37 @@ entries: - https://github.com/truecharts/apps/releases/download/phpldapadmin-4.0.20/phpldapadmin-4.0.20.tgz version: 4.0.20 piaware: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "6.1" + created: "2021-12-21T18:46:11.691544806Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Program for forwarding ADS-B data to FlightAware + digest: d9309b30e4129f9d9284d893b78a8630a5e9be1c4b962434ff09a2987b6bec8a + home: https://github.com/truechartsapps/tree/master/charts/stable/piaware + icon: https://truecharts.org/_static/img/appicons/piaware-icon.png + keywords: + - piaware + - flight-aware + - flight-tracker + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: piaware + sources: + - https://github.com/flightaware/piaware + urls: + - https://github.com/truecharts/apps/releases/download/piaware-4.0.31/piaware-4.0.31.tgz + version: 4.0.31 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22001,6 +26856,37 @@ entries: - https://github.com/truecharts/apps/releases/download/piaware-4.0.20/piaware-4.0.20.tgz version: 4.0.20 pidgin: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.14.3 + created: "2021-12-21T18:46:11.835695833Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Pidgin is a chat program which lets you log into accounts on multiple + chat networks simultaneously. + digest: 15e554353d7af2f48331a1ae4cb79e4d5f6c47628f77cbd6d5046f95baed0bae + home: https://github.com/truecharts/apps/tree/master/charts/stable/pidgin + icon: https://truecharts.org/_static/img/appicons/pidgin-icon.png + keywords: + - pidgin + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pidgin + sources: + - https://hub.docker.com/r/linuxserver/pidgin + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pidgin-0.0.7/pidgin-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22126,6 +27012,38 @@ entries: - https://github.com/truecharts/apps/releases/download/pidgin-0.0.1/pidgin-0.0.1.tgz version: 0.0.1 pihole: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - networking + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.10.1 + created: "2021-12-21T18:46:12.00403636Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: DNS and Ad-filtering for your network + digest: d9d483016fe25a32664f8ba143b1de2f71d040e9dffb20358eace7bda4e1b0c3 + home: https://github.com/truecharts/apps/tree/master/charts/stable/pihole + icon: https://truecharts.org/_static/img/appicons/pihole-icon.png + keywords: + - DNS + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pihole + sources: + - https://pi-hole.net/ + - https://github.com/pi-hole + - https://github.com/pi-hole/docker-pi-hole + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pihole-4.0.29/pihole-4.0.29.tgz + version: 4.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22255,6 +27173,41 @@ entries: - https://github.com/truecharts/apps/releases/download/pihole-4.0.22/pihole-4.0.22.tgz version: 4.0.22 piwigo: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 11.5.0 + created: "2021-12-21T18:46:12.146319817Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A is photo gallery software for the web, built by an active community + of users and developers. + digest: eb48d19a553bc08b9ec3fc7e53ffc07371e1608c4268e3f386b85c14717596ba + home: https://github.com/truecharts/apps/tree/master/charts/stable/piwigo + icon: https://truecharts.org/_static/img/appicons/piwigo-icon.png + keywords: + - piwigo + - gallery + - photo + - image + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: piwigo + sources: + - http://piwigo.org/ + - https://github.com/linuxserver/docker-piwigo + type: application + urls: + - https://github.com/truecharts/apps/releases/download/piwigo-1.0.27/piwigo-1.0.27.tgz + version: 1.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22361,6 +27314,41 @@ entries: - https://github.com/truecharts/apps/releases/download/piwigo-1.0.22/piwigo-1.0.22.tgz version: 1.0.22 pixapop: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "1.2" + created: "2021-12-21T18:46:12.301052169Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An open-source single page application to view your photos in the + easiest way possible. + digest: cb7e32a95d1ce2099ebd63a9d516fffcc75d1cfbea41a0aa17a0d996211fb97a + home: https://github.com/truecharts/apps/tree/master/charts/stable/pixapop + icon: https://truecharts.org/_static/img/appicons/pixapop-icon.png + keywords: + - pixapop + - photo + - gallery + - image + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pixapop + sources: + - https://github.com/linuxserver/docker-pixapop + - https://github.com/bierdok/pixapop + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pixapop-1.0.26/pixapop-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22467,6 +27455,37 @@ entries: - https://github.com/truecharts/apps/releases/download/pixapop-1.0.21/pixapop-1.0.21.tgz version: 1.0.21 plex: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.24.5.517 + created: "2021-12-21T18:46:12.456136416Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Plex Media Server + digest: 7f2083c75dcacec068b47ea51ec8b8b1087dc6d9e3039f141efef4b454168a94 + home: https://github.com/truecharts/apps/tree/master/charts/stable/plex + icon: https://truecharts.org/_static/img/appicons/plex-icon.png + keywords: + - plex + - plex-media-server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: plex + sources: + - https://github.com/k8s-at-home/container-images/pkgs/container/plex + type: application + urls: + - https://github.com/truecharts/apps/releases/download/plex-8.0.27/plex-8.0.27.tgz + version: 8.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -22561,6 +27580,38 @@ entries: - https://github.com/truecharts/apps/releases/download/plex-8.0.22/plex-8.0.22.tgz version: 8.0.22 podgrab: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - mutlimedia + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.0 + created: "2021-12-21T18:46:12.625974019Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A self-hosted podcast manager to download episodes as soon as they + become live. + digest: bb572f7b6553458ec958e8b31dcee0b39fced9aa199ef1df395e8d28691ece46 + home: https://github.com/truecharts/apps/tree/master/charts/stable/podgrab + icon: https://truecharts.org/_static/img/appicons/podgrab-icon.png + keywords: + - podgrab + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: podgrab + sources: + - https://github.com/akhilrex/podgrab + - https://hub.docker.com/r/akhilrex/podgrab + type: application + urls: + - https://github.com/truecharts/apps/releases/download/podgrab-8.0.7/podgrab-8.0.7.tgz + version: 8.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -23218,6 +28269,39 @@ entries: - https://github.com/truecharts/apps/releases/download/postgresql-6.0.22/postgresql-6.0.22.tgz version: 6.0.22 pretend-youre-xyzzy: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "4" + created: "2021-12-21T18:46:12.771194427Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: pretend-youre-xyzzy, a cards against humanity clone + digest: 90b01650d3c79e387f84acef55547fc592c1cf82845ebf6fd5dbf02751ec4e0f + home: https://github.com/truechartsapps/tree/master/charts/stable/pretend-youre-xyzzy + icon: https://truecharts.org/_static/img/appicons/pretend-youre-xyzzy-icon.png + keywords: + - pretend-youre-xyzzy + - cards + - against + - humanity + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pretend-youre-xyzzy + sources: + - https://github.com/ajanata/PretendYoureXyzzy + - https://github.com/emcniece/DockerYourXyzzy + urls: + - https://github.com/truecharts/apps/releases/download/pretend-youre-xyzzy-4.0.26/pretend-youre-xyzzy-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -23318,6 +28402,35 @@ entries: - https://github.com/truecharts/apps/releases/download/pretend-youre-xyzzy-4.0.21/pretend-youre-xyzzy-4.0.21.tgz version: 4.0.21 projectsend: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.12.10 + created: "2021-12-21T18:46:12.931742683Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Projectsend is a self-hosted application that lets you upload files + and assign them to specific clients that you create yourself. + digest: 3082247cbbe5cac8574f8200962d19c5d041b91bea9861adf6ad3694df0debd2 + home: https://github.com/truecharts/apps/tree/master/charts/stable/projectsend + icon: https://truecharts.org/_static/img/appicons/projectsend-icon.png - projectsend + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: projectsend + sources: + - https://hub.docker.com/r/linuxserver/projectsend + type: application + urls: + - https://github.com/truecharts/apps/releases/download/projectsend-0.0.7/projectsend-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -23438,6 +28551,38 @@ entries: - https://github.com/truecharts/apps/releases/download/projectsend-0.0.1/projectsend-0.0.1.tgz version: 0.0.1 promcord: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:13.088579601Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Discord bot that provides metrics from a Discord server + digest: dc23150331ff850aa2d744366fae74ad085a9f05b17441f424719cb09fa9de73 + home: https://github.com/k8s-at-home/charts/tree/master/charts/stable/promcord + icon: https://truecharts.org/_static/img/appicons/promcord-icon.png + keywords: + - promcord + - discord + - metrics + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: promcord + sources: + - https://github.com/nimarion/promcord + type: application + urls: + - https://github.com/truecharts/apps/releases/download/promcord-2.0.7/promcord-2.0.7.tgz + version: 2.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -23567,6 +28712,48 @@ entries: - https://github.com/truecharts/apps/releases/download/promcord-2.0.0/promcord-2.0.0.tgz version: 2.0.0 prometheus: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.53.0 + created: "2021-12-21T18:46:13.279817752Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: exporters.enabled,exporters.node-exporter.enabled + name: node-exporter + repository: https://charts.bitnami.com/bitnami + version: 2.3.17 + - condition: exporters.enabled,exporters.kube-state-metrics.enabled + name: kube-state-metrics + repository: https://charts.bitnami.com/bitnami + version: 2.1.19 + description: kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, + and Prometheus rules combined with documentation and scripts to provide easy + to operate end-to-end Kubernetes cluster monitoring with Prometheus using the + Prometheus Operator. + digest: 0f7ebe0cac70ed8c9a61bc2b5cbcdc425902581e4169afb42094d4056cb7afb7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/prometheus + icon: https://truecharts.org/_static/img/appicons/prometheus-icon.png + keywords: + - metrics + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: prometheus + sources: + - https://github.com/prometheus-community/helm-charts + - https://github.com/prometheus-operator/kube-prometheus + type: application + urls: + - https://github.com/truecharts/apps/releases/download/prometheus-1.1.27/prometheus-1.1.27.tgz + version: 1.1.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -24395,6 +29582,37 @@ entries: - https://github.com/truecharts/apps/releases/download/promtail-1.0.10/promtail-1.0.10.tgz version: 1.0.10 protonmail-bridge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.8.10 + created: "2021-12-21T18:46:13.421567217Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Container for protonmail bridge to work on the network. + digest: 94b0caeb43a6fc0fbcb4022f92900ba608d1805555d78a9a800e9755a1e3f9d7 + home: https://github.com/truechartsapps/tree/master/charts/stable/protonmail-bridge + icon: https://truecharts.org/_static/img/appicons/protonmail-bridge-icon.png + keywords: + - protonmail + - protonmail-bridge + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: protonmail-bridge + sources: + - https://github.com/shenxn/protonmail-bridge-docker + - https://hub.docker.com/r/shenxn/protonmail-bridge + urls: + - https://github.com/truecharts/apps/releases/download/protonmail-bridge-4.0.26/protonmail-bridge-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -24489,6 +29707,39 @@ entries: - https://github.com/truecharts/apps/releases/download/protonmail-bridge-4.0.21/protonmail-bridge-4.0.21.tgz version: 4.0.21 prowlarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.1.8.1265 + created: "2021-12-21T18:46:13.557333482Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Indexer manager/proxy built on the popular arr net base stack to + integrate with your various PVR apps. + digest: 5f5572fea2a0baaa12767fb2a608db5fb99d9c3078daac1cffb3d05da7c02bb5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/prowlarr + icon: https://truecharts.org/_static/img/appicons/prowlarr-icon.png + keywords: + - prowlarr + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: prowlarr + sources: + - https://github.com/Prowlarr/Prowlarr + - https://github.com/k8s-at-home/container-images + urls: + - https://github.com/truecharts/apps/releases/download/prowlarr-4.0.45/prowlarr-4.0.45.tgz + version: 4.0.45 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -24853,6 +30104,37 @@ entries: - https://github.com/truecharts/apps/releases/download/prowlarr-4.0.30/prowlarr-4.0.30.tgz version: 4.0.30 pwndrop: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.1 + created: "2021-12-21T18:46:13.704742954Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Pwndrop is a self-deployable file hosting service for sending out + red teaming payloads or securely sharing your private files over HTTP and WebDAV. + digest: bc94a5f622048e045e06870b7f4825479ef54906b55e3c2bd7db9695285663de + home: https://github.com/truecharts/apps/tree/master/charts/stable/pwndrop + icon: https://truecharts.org/_static/img/appicons/pwndrop-icon.png + keywords: + - pwndrop + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pwndrop + sources: + - https://hub.docker.com/r/linuxserver/pwndrop + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pwndrop-0.0.7/pwndrop-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -24978,6 +30260,36 @@ entries: - https://github.com/truecharts/apps/releases/download/pwndrop-0.0.1/pwndrop-0.0.1.tgz version: 0.0.1 pydio-cells: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.0.3 + created: "2021-12-21T18:46:13.846593518Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Pydio-cells is the nextgen file sharing platform for organizations. + digest: 22c683f619f9258fac03f18efd6394b9260bdd8cb838989fcce16ff94cbf8ea7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/pydio-cells + icon: https://truecharts.org/_static/img/appicons/pydio-cells-icon.png + keywords: + - pydio-cells + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pydio-cells + sources: + - https://hub.docker.com/r/linuxserver/pydio-cells + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pydio-cells-0.0.8/pydio-cells-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25129,6 +30441,39 @@ entries: - https://github.com/truecharts/apps/releases/download/pydio-cells-0.0.1/pydio-cells-0.0.1.tgz version: 0.0.1 pyload: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5de90278 + created: "2021-12-21T18:46:14.001162073Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: pyLoad is a Free and Open Source download manager written in Python + and designed to be extremely lightweight, easily extensible and fully manageable + via web. + digest: fdcfa66b022bfee0b552bbfe0fa47ef0b6d23810bab323d8f3c365d2c8300c57 + home: https://github.com/truechartsapps/tree/master/charts/stable/pyload + icon: https://truecharts.org/_static/img/appicons/pyload-icon.png + keywords: + - pyload + - download + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pyload + sources: + - https://github.com/pyload/pyload + - https://hub.docker.com/r/linuxserver/pyload + urls: + - https://github.com/truecharts/apps/releases/download/pyload-4.0.26/pyload-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25229,6 +30574,36 @@ entries: - https://github.com/truecharts/apps/releases/download/pyload-4.0.21/pyload-4.0.21.tgz version: 4.0.21 pylon: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.7.0 + created: "2021-12-21T18:46:14.140576477Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Pylon is a web based integrated development environment. + digest: e55db0e80fc30ab9fea46e8d03806a4ff2d98bc6ecdfd30011e7f0f8fef25a39 + home: https://github.com/truecharts/apps/tree/master/charts/stable/pylon + icon: https://truecharts.org/_static/img/appicons/pylon-icon.png + keywords: + - pylon + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: pylon + sources: + - https://hub.docker.com/r/linuxserver/pylon + type: application + urls: + - https://github.com/truecharts/apps/releases/download/pylon-0.0.7/pylon-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25350,6 +30725,37 @@ entries: - https://github.com/truecharts/apps/releases/download/pylon-0.0.1/pylon-0.0.1.tgz version: 0.0.1 qbittorrent: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.3.9 + created: "2021-12-21T18:46:14.287914151Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: qBittorrent is a cross-platform free and open-source BitTorrent client + digest: 08fd007444e12bc7e249b3a82099cc1f63a8e83f46ed6a320b7aa5b8d3f814ab + home: https://github.com/truecharts/apps/tree/master/charts/stable/qbittorrent + icon: https://truecharts.org/_static/img/appicons/qbittorrent-icon.png + keywords: + - qbittorrent + - torrrent + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: qbittorrent + sources: + - https://github.com/qbittorrent/qBittorrent + type: application + urls: + - https://github.com/truecharts/apps/releases/download/qbittorrent-9.0.29/qbittorrent-9.0.29.tgz + version: 9.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25444,6 +30850,40 @@ entries: - https://github.com/truecharts/apps/releases/download/qbittorrent-9.0.24/qbittorrent-9.0.24.tgz version: 9.0.24 quassel-core: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.13.1 + created: "2021-12-21T18:46:14.463375161Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Quassel-core is a modern, cross-platform, distributed IRC client. + digest: bc5214defa446dbda5ba0da310357c42fe4750ee0f41cdeb9ae72bc311febe38 + home: https://github.com/truecharts/apps/tree/master/charts/stable/quassel-core + icon: https://truecharts.org/_static/img/appicons/quassel-core-icon.png + keywords: + - quassel-core + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: quassel-core + sources: + - https://hub.docker.com/r/linuxserver/quassel-core + type: application + urls: + - https://github.com/truecharts/apps/releases/download/quassel-core-0.0.8/quassel-core-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25615,6 +31055,36 @@ entries: - https://github.com/truecharts/apps/releases/download/quassel-core-0.0.1/quassel-core-0.0.1.tgz version: 0.0.1 quassel-web: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.18 + created: "2021-12-21T18:46:14.57764078Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Quassel-web is a web client for Quassel. + digest: c00bbcb6a83db3069195c128d81134430b72b75c8c1010f4728b5a5ff7fd974c + home: https://github.com/truecharts/apps/tree/master/charts/stable/quassel-web + icon: https://truecharts.org/_static/img/appicons/quassel-web-icon.png + keywords: + - quassel-web + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: quassel-web + sources: + - https://hub.docker.com/r/linuxserver/quassel-web + type: application + urls: + - https://github.com/truecharts/apps/releases/download/quassel-web-0.0.7/quassel-web-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25736,6 +31206,38 @@ entries: - https://github.com/truecharts/apps/releases/download/quassel-web-0.0.1/quassel-web-0.0.1.tgz version: 0.0.1 radarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.2.2.5080 + created: "2021-12-21T18:46:14.741196386Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A fork of Sonarr to work with movies à la Couchpotato + digest: a8cef47aa56b3c519f3eeb86e371e0accd3d0b0f24a64e72b1d5b8ee346d1531 + home: https://github.com/truecharts/apps/tree/master/charts/stable/radarr + icon: https://truecharts.org/_static/img/appicons/radarr-icon.png + keywords: + - radarr + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: radarr + sources: + - https://github.com/Radarr/Radarr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/radarr-9.0.27/radarr-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -25833,6 +31335,41 @@ entries: - https://github.com/truecharts/apps/releases/download/radarr-9.0.22/radarr-9.0.22.tgz version: 9.0.22 readarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.1.0.1142 + created: "2021-12-21T18:46:14.894677359Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A fork of Radarr to work with Books & AudioBooks + digest: 2697abc0ec4665aa6891dd4d418b493ab0652e051cb03d746f0e3d8d1882f9d1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/readarr + icon: https://truecharts.org/_static/img/appicons/readarr-icon.png + keywords: + - readarr + - torrent + - usenet + - AudioBooks + - ebooks + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: readarr + sources: + - https://github.com/Readarr/Readarr + - https://readarr.com + type: application + urls: + - https://github.com/truecharts/apps/releases/download/readarr-9.0.41/readarr-9.0.41.tgz + version: 9.0.41 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -26079,6 +31616,43 @@ entries: - https://github.com/truecharts/apps/releases/download/readarr-9.0.30/readarr-9.0.30.tgz version: 9.0.30 recipes: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.0.3 + created: "2021-12-21T18:46:15.051045284Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Recipes is a Django application to manage, tag and search recipes + using either built in models or external storage providers hosting PDF's, Images + or other files. + digest: ea36d176890d0c165774e5a30ce3320056eddf4c1b52aad8f11a7d9b788f72d3 + home: https://github.com/truecharts/apps/tree/master/charts/stable/recipes + icon: https://truecharts.org/_static/img/appicons/recipes-icon.png + keywords: + - recipes + - cooking + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: recipes + sources: + - https://github.com/vabene1111/recipes + - https://hub.docker.com/r/vabene1111/recipes + urls: + - https://github.com/truecharts/apps/releases/download/recipes-5.0.4/recipes-5.0.4.tgz + version: 5.0.4 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -26702,6 +32276,37 @@ entries: - https://github.com/truecharts/apps/releases/download/redis-1.0.27/redis-1.0.27.tgz version: 1.0.27 reg: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - utilities + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.16.1 + created: "2021-12-21T18:46:15.21097745Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Docker registry v2 command line client and repo listing generator + with security checks. + digest: 249b08dad2d00421106ff1af9dbaadeff98380a05c0115eb99ee4fa469193b9c + home: https://github.com/truecharts/apps/tree/master/charts/stable/reg + icon: https://truecharts.org/_static/img/appicons/reg-icon.png + keywords: + - reg + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: reg + sources: + - https://github.com/genuinetools/reg + - https://github.com/k8s-at-home/container-images/ + urls: + - https://github.com/truecharts/apps/releases/download/reg-4.0.25/reg-4.0.25.tgz + version: 4.0.25 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -26796,6 +32401,40 @@ entries: - https://github.com/truecharts/apps/releases/download/reg-4.0.20/reg-4.0.20.tgz version: 4.0.20 remmina: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.2.0-rcgi + created: "2021-12-21T18:46:15.367189178Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A remote desktop client written in GTK + digest: b48680588514c668052de88e2234c6edacc5e951bdf39d2358309adda469311d + home: https://github.com/truecharts/apps/tree/master/charts/stable/remmina + icon: https://truecharts.org/_static/img/appicons/remmina-icon.png + keywords: + - remina + - remote + - desktop + - client + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: remmina + sources: + - https://github.com/linuxserver/docker-remmina + - https://remmina.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/remmina-1.0.30/remmina-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -26899,6 +32538,37 @@ entries: - https://github.com/truecharts/apps/releases/download/remmina-1.0.25/remmina-1.0.25.tgz version: 1.0.25 requestrr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.1 + created: "2021-12-21T18:46:15.539609939Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Requestrr is a chatbot used to simplify using services like Sonarr/Radarr/Ombi + via the use of chat. + digest: 600d9e596ee361cd005091ca4da8646ab8bbfeaece113cc11ff7f8e937a038dd + home: https://github.com/truecharts/apps/tree/master/charts/stable/requestrr + icon: https://truecharts.org/_static/img/appicons/requestrr-icon.png + keywords: + - requestrr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: requestrr + sources: + - https://hub.docker.com/r/linuxserver/requestrr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/requestrr-0.0.7/requestrr-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27024,6 +32694,39 @@ entries: - https://github.com/truecharts/apps/releases/download/requestrr-0.0.1/requestrr-0.0.1.tgz version: 0.0.1 resilio-sync: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.7.2.1375 + created: "2021-12-21T18:46:15.693857199Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Resilio Sync is a fast, reliable, and simple file sync and share + solution, powered by P2P technology + digest: 180869b617596f03f3b6f0c9529d1d6def502b2cab7692fea2e38a3cb9ca4320 + home: https://github.com/truechartsapps/tree/master/charts/stable/resio-sync + icon: https://truecharts.org/_static/img/appicons/resilio-sync-icon.png + keywords: + - resilio + - sync + - btsync + - bittorrent + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: resilio-sync + sources: + - https://github.com/orgs/linuxserver/packages/container/package/resilio-sync + urls: + - https://github.com/truecharts/apps/releases/download/resilio-sync-4.0.27/resilio-sync-4.0.27.tgz + version: 4.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27157,6 +32860,36 @@ entries: - https://github.com/truecharts/apps/releases/download/resilio-sync-4.0.21/resilio-sync-4.0.21.tgz version: 4.0.21 rsnapshot: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.4.3 + created: "2021-12-21T18:46:15.836170755Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Rsnapshot is a filesystem snapshot utility based on rsync. + digest: dbad57c8a0661c2bb9f958b6cf8bb333186ec4c8da86546995035e0d071034f7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/rsnapshot + icon: https://truecharts.org/_static/img/appicons/rsnapshot-icon.png + keywords: + - rsnapshot + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: rsnapshot + sources: + - https://hub.docker.com/r/linuxserver/rsnapshot + type: application + urls: + - https://github.com/truecharts/apps/releases/download/rsnapshot-0.0.7/rsnapshot-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27278,6 +33011,37 @@ entries: - https://github.com/truecharts/apps/releases/download/rsnapshot-0.0.1/rsnapshot-0.0.1.tgz version: 0.0.1 sabnzbd: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.4.2 + created: "2021-12-21T18:46:16.040803293Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Free and easy binary newsreader + digest: 75dc84d72ee990e0b73913dda67525b506e75f0ac66be31bfd61a8d8bc04c7be + home: https://github.com/truecharts/apps/tree/master/charts/stable/sabnzbd + icon: https://truecharts.org/_static/img/appicons/sabnzbd-icon.png + keywords: + - sabnzbd + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: sabnzbd + sources: + - https://sabnzbd.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/sabnzbd-9.0.26/sabnzbd-9.0.26.tgz + version: 9.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27372,6 +33136,37 @@ entries: - https://github.com/truecharts/apps/releases/download/sabnzbd-9.0.21/sabnzbd-9.0.21.tgz version: 9.0.21 scrutiny: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.11.18 + created: "2021-12-21T18:46:16.189510273Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Scrutiny WebUI for smartd S.M.A.R.T monitoring. Scrutiny is a Hard + Drive Health Dashboard & Monitoring solution. + digest: cc39028979a21d2e8bbdec0a9857964223d954d4176bc84d0f8a8f4fc8b53c99 + home: https://github.com/truecharts/apps/tree/master/charts/stable/scrutiny + icon: https://truecharts.org/_static/img/appicons/scrutiny-icon.png + keywords: + - scrutiny + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: scrutiny + sources: + - https://hub.docker.com/r/linuxserver/scrutiny + type: application + urls: + - https://github.com/truecharts/apps/releases/download/scrutiny-0.0.8/scrutiny-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27528,6 +33323,36 @@ entries: - https://github.com/truecharts/apps/releases/download/scrutiny-0.0.1/scrutiny-0.0.1.tgz version: 0.0.1 ser2sock: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:16.33197011Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Serial to Socket Redirector + digest: 4f91c5d7101c9f6c7aba85e082819dd91e1988da7abeaac9660e6947fe6f37f9 + home: https://github.com/truechartsapps/tree/master/charts/stable/ser2sock + icon: https://truecharts.org/_static/img/appicons/ser2sock-icon.png + keywords: + - ser2sock + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ser2sock + sources: + - https://github.com/nutechsoftware/ser2sock + - https://github.com/tenstartups/ser2sock + urls: + - https://github.com/truecharts/apps/releases/download/ser2sock-4.0.26/ser2sock-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27619,6 +33444,44 @@ entries: - https://github.com/truecharts/apps/releases/download/ser2sock-4.0.21/ser2sock-4.0.21.tgz version: 4.0.21 shiori: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.5.0 + created: "2021-12-21T18:46:16.537675565Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: A simple bookmark manager built with Go + digest: 2a9a6b8d3d7780cf509491c442ba2053715c9e5663fb9a20840039e77ba2f079 + home: https://github.com/truecharts/apps/tree/main/charts/shiori + icon: https://truecharts.org/_static/img/appicons/shiori-icon.png + keywords: + - shiori + - bookmark + - bookmark-manager + - web-interface + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: shiori + sources: + - https://github.com/go-shiori/shiori + - https://github.com/nicholaswilde/docker-shiori + type: application + urls: + - https://github.com/truecharts/apps/releases/download/shiori-4.0.17/shiori-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27734,6 +33597,40 @@ entries: - https://github.com/truecharts/apps/releases/download/shiori-4.0.12/shiori-4.0.12.tgz version: 4.0.12 shorturl: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.1.0 + created: "2021-12-21T18:46:16.732319697Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Self hosted web app for shortening urls (URL shortener) + digest: a6cad56fb7f1c0e68270aad5a4286e63eeb4c8854d9e7e5429073a589426f4b3 + home: https://github.com/truecharts/apps/tree/master/charts/stable/shorturl + icon: https://truecharts.org/_static/img/appicons/shorturl-icon.png + keywords: + - url + - shortener + - shorten + - shorturl + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: shorturl + sources: + - https://github.com/prologic/shorturl + - https://github.com/nicholaswilde/docker-shorturl + type: application + urls: + - https://github.com/truecharts/apps/releases/download/shorturl-1.0.26/shorturl-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27837,6 +33734,40 @@ entries: - https://github.com/truecharts/apps/releases/download/shorturl-1.0.21/shorturl-1.0.21.tgz version: 1.0.21 sickchill: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2021.5.10 + created: "2021-12-21T18:46:16.880603588Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An Automatic Video Library Manager for TV Shows + digest: e7d1a186a8fcb9f9f2a9594742ddc522484fdef1546cd4ba3769ad339eac3294 + home: https://github.com/truecharts/apps/tree/master/charts/stable/sickchill + icon: https://truecharts.org/_static/img/appicons/sickchill-icon.png + keywords: + - sickchill + - video + - library + - manager + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: sickchill + sources: + - https://github.com/linuxserver/docker-sickchill + - https://github.com/SickChill/SickChill + type: application + urls: + - https://github.com/truecharts/apps/releases/download/sickchill-1.0.26/sickchill-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -27940,6 +33871,41 @@ entries: - https://github.com/truecharts/apps/releases/download/sickchill-1.0.21/sickchill-1.0.21.tgz version: 1.0.21 sickgear: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.25.4 + created: "2021-12-21T18:46:17.024398091Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Provides management of TV shows and/or Anime, it detects new episodes, + links downloader apps, and more + digest: 897bb926869286c7bf09fc512e8431a51be78770f6c87b1d8f255f0f2019eab1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/sickgear + icon: https://truecharts.org/_static/img/appicons/sickgear-icon.png + keywords: + - sickgear + - manager + - tv + - shows + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: sickgear + sources: + - https://github.com/linuxserver/docker-sickgear + - https://github.com/SickGear/SickGear + type: application + urls: + - https://github.com/truecharts/apps/releases/download/sickgear-1.0.26/sickgear-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28046,6 +34012,39 @@ entries: - https://github.com/truecharts/apps/releases/download/sickgear-1.0.21/sickgear-1.0.21.tgz version: 1.0.21 smokeping: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.7.3 + created: "2021-12-21T18:46:17.183021424Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Keep track of your network latency. + digest: 3d1fb7136561168f1117b1395c8faea1a08b722e90bed20d8d75dc0526ffb096 + home: https://github.com/truecharts/apps/tree/master/charts/stable/smokeping + icon: https://truecharts.org/_static/img/appicons/smokeping-icon.png + keywords: + - smokeping + - network + - latency + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: smokeping + sources: + - https://oss.oetiker.ch/smokeping/ + - https://hub.docker.com/r/linuxserver/smokeping + type: application + urls: + - https://github.com/truecharts/apps/releases/download/smokeping-1.0.28/smokeping-1.0.28.tgz + version: 1.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28146,6 +34145,43 @@ entries: - https://github.com/truecharts/apps/releases/download/smokeping-1.0.23/smokeping-1.0.23.tgz version: 1.0.23 snipe-it: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - management + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.3.6 + created: "2021-12-21T18:46:17.336042196Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: Open source asset management + digest: 99d5e3a90b61775d5f9fbc20cbd87f817500865cd6aa5fd73908ba4043866443 + home: https://github.com/truechartsapps/tree/master/charts/stable/snipe-it + icon: https://truecharts.org/_static/img/appicons/snipe-it-icon.png + keywords: + - snipeit + - snipe + - asset + - management + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: snipe-it + sources: + - https://snipeitapp.com/ + - https://hub.docker.com/r/linuxserver/ + urls: + - https://github.com/truecharts/apps/releases/download/snipe-it-0.0.18/snipe-it-0.0.18.tgz + version: 0.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28332,6 +34368,38 @@ entries: - https://github.com/truecharts/apps/releases/download/snipe-it-0.0.11/snipe-it-0.0.11.tgz version: 0.0.11 sonarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.0.6.1342 + created: "2021-12-21T18:46:17.499051319Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Smart PVR for newsgroup and bittorrent users + digest: e66f3f9dc62ca61fc24021cc40e2c7ba08efae7189875460748f106c81c25bbe + home: https://github.com/truecharts/apps/tree/master/charts/stable/sonarr + icon: https://truecharts.org/_static/img/appicons/sonarr-icon.png + keywords: + - sonarr + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: sonarr + sources: + - https://github.com/Sonarr/Sonarr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/sonarr-9.0.28/sonarr-9.0.28.tgz + version: 9.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28461,6 +34529,38 @@ entries: - https://github.com/truecharts/apps/releases/download/sonarr-9.0.22/sonarr-9.0.22.tgz version: 9.0.22 speedtest-exporter: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.3.4 + created: "2021-12-21T18:46:17.659777499Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Speedtest Exporter made in python using the official speedtest bin + digest: 9566d656e2868b6acf117e3a1ecc4bd5640d195a13e1e1fbd84232c1d80e25b4 + home: https://github.com/k8s-at-home/charts/tree/master/charts/stable/speedtest-exporter + icon: https://truecharts.org/_static/img/appicons/speedtest-exporter-icon.png + keywords: + - speedtest-exporter + - speedtest + - metrics + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: speedtest-exporter + sources: + - https://github.com/MiguelNdeCarvalho/speedtest-exporter/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/speedtest-exporter-1.0.13/speedtest-exporter-1.0.13.tgz + version: 1.0.13 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28558,6 +34658,41 @@ entries: - https://github.com/truecharts/apps/releases/download/speedtest-exporter-1.0.8/speedtest-exporter-1.0.8.tgz version: 1.0.8 sqlitebrowser: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.12.2 + created: "2021-12-21T18:46:17.827842295Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A high quality, visual, open source tool to create, design, and edit + database files compatible with SQLite + digest: 93f4543d1fc6f52bc956aceca8b12175910d722c60214260187448c06783ce90 + home: https://github.com/truecharts/apps/tree/master/charts/stable/sqlitebrowser + icon: https://truecharts.org/_static/img/appicons/sqlitebrowser-icon.png + keywords: + - sqlite + - browser + - sqlitebrowser + - database + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: sqlitebrowser + sources: + - https://github.com/linuxserver/docker-sqlitebrowser + - https://sqlitebrowser.org/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/sqlitebrowser-1.0.30/sqlitebrowser-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28664,6 +34799,36 @@ entries: - https://github.com/truecharts/apps/releases/download/sqlitebrowser-1.0.25/sqlitebrowser-1.0.25.tgz version: 1.0.25 stash: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.11.0 + created: "2021-12-21T18:46:17.977692047Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: An organizer for your porn, written in Go + digest: 58289385906c2ea88a74e86b4fd29c4f3d75bcd03c50fa92047dec1f6971fb9a + home: https://github.com/truechartsapps/tree/master/charts/stable/stash + icon: https://truecharts.org/_static/img/appicons/stash-icon.png + keywords: + - porn + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: stash + sources: + - https://github.com/stashapp/stash + - https://hub.docker.com/r/stashapp/stash + urls: + - https://github.com/truecharts/apps/releases/download/stash-5.0.7/stash-5.0.7.tgz + version: 5.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28815,6 +34980,41 @@ entries: - https://github.com/truecharts/apps/releases/download/stash-4.0.20/stash-4.0.20.tgz version: 4.0.20 static: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: ee8a20c + created: "2021-12-21T18:46:18.104804568Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A self-hosted static file serving app which does nothing more than + just serve up static files from a mounted volume. + digest: 93b6a93f60708c1469fc2750e20163422ad699a6f661b3e54ef27c4ba5b604c5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/static + icon: https://truecharts.org/_static/img/appicons/static-icon.png + keywords: + - app + - web + - filesystem + - static + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: static + sources: + - https://github.com/prologic/static + - https://github.com/nicholaswilde/docker-static + type: application + urls: + - https://github.com/truecharts/apps/releases/download/static-1.0.26/static-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -28919,6 +35119,41 @@ entries: - https://github.com/truecharts/apps/releases/download/static-1.0.21/static-1.0.21.tgz version: 1.0.21 statping: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.90.74 + created: "2021-12-21T18:46:18.273136557Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Status page for monitoring your websites and applications + digest: 19bdc9e487af32ff81ebd34d1047ced3fa933761891ce6f3d8d2aa26e3abeecd + home: https://github.com/truecharts/apps/tree/master/charts/stable/statping + icon: https://truecharts.org/_static/img/appicons/statping-icon.png + keywords: + - statping + - status + - status-page + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: statping + sources: + - https://github.com/statping/statping + urls: + - https://github.com/truecharts/apps/releases/download/statping-4.0.17/statping-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29025,6 +35260,37 @@ entries: - https://github.com/truecharts/apps/releases/download/statping-4.0.12/statping-4.0.12.tgz version: 4.0.12 synclounge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 5.1.111 + created: "2021-12-21T18:46:18.428640268Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Synclounge is a third party tool that allows you to watch Plex in + sync with your friends/family, wherever you are. + digest: c930ce03c3dc14347ac89684da85443d4f2c145ab267838fa19339dfc6141f27 + home: https://github.com/truecharts/apps/tree/master/charts/stable/synclounge + icon: https://truecharts.org/_static/img/appicons/synclounge-icon.png + keywords: + - synclounge + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: synclounge + sources: + - https://hub.docker.com/r/linuxserver/synclounge + type: application + urls: + - https://github.com/truecharts/apps/releases/download/synclounge-0.0.7/synclounge-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29150,6 +35416,38 @@ entries: - https://github.com/truecharts/apps/releases/download/synclounge-0.0.1/synclounge-0.0.1.tgz version: 0.0.1 syncthing: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.18.5 + created: "2021-12-21T18:46:18.590500035Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: P2P file synchronization application + digest: 19157a5eeabc3ffe53d87c8aa5da9ad5810fc3fc7338528b9b538ddfe2d58a5b + home: https://github.com/truecharts/apps/tree/master/charts/stable/syncthing + icon: https://truecharts.org/_static/img/appicons/syncthing-icon.png + keywords: + - syncthing + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: syncthing + sources: + - https://syncthing.net/ + - https://github.com/syncthing/syncthing + - https://hub.docker.com/r/syncthing/syncthing + type: application + urls: + - https://github.com/truecharts/apps/releases/download/syncthing-9.0.28/syncthing-9.0.28.tgz + version: 9.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29311,6 +35609,37 @@ entries: - https://github.com/truecharts/apps/releases/download/syncthing-9.0.20/syncthing-9.0.20.tgz version: 9.0.20 syslog-ng: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.30.1 + created: "2021-12-21T18:46:18.731719869Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: syslog-ng allows you to flexibly collect, parse, classify, rewrite + and correlate logs. + digest: fc8a62232d431a1e07d4ddd11ce12d85e002244619e1ff7aebdec3563ac156bf + home: https://github.com/truecharts/apps/tree/master/charts/stable/syslog-ng + icon: https://truecharts.org/_static/img/appicons/syslog-ng-icon.png + keywords: + - syslog-ng + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: syslog-ng + sources: + - https://hub.docker.com/r/linuxserver/syslog-ng + type: application + urls: + - https://github.com/truecharts/apps/releases/download/syslog-ng-0.0.8/syslog-ng-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29467,6 +35796,37 @@ entries: - https://github.com/truecharts/apps/releases/download/syslog-ng-0.0.1/syslog-ng-0.0.1.tgz version: 0.0.1 tautulli: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.8.0 + created: "2021-12-21T18:46:18.87838197Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A Python based monitoring and tracking tool for Plex Media Server + digest: f9d7bbcc0eca29f7dc4d6127e5bba0eec069169fa964d1239c81ffe47e1cf725 + home: https://github.com/truecharts/apps/tree/master/charts/stable/tautulli + icon: https://truecharts.org/_static/img/appicons/tautulli-icon.png + keywords: + - tautulli + - plex + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: tautulli + sources: + - https://github.com/Tautulli/Tautulli + type: application + urls: + - https://github.com/truecharts/apps/releases/download/tautulli-9.0.27/tautulli-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29592,6 +35952,39 @@ entries: - https://github.com/truecharts/apps/releases/download/tautulli-9.0.21/tautulli-9.0.21.tgz version: 9.0.21 tdarr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.00.12 + created: "2021-12-21T18:46:19.022789926Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Audio/Video library transcoding automation + digest: fa4be1bb5b55fc2388047681356b80195841a327b03ded6bc7c23b4dda66ef51 + home: https://github.com/truecharts/apps/tree/master/charts/stable/tdarr + icon: https://truecharts.org/_static/img/appicons/tdarr-icon.png + keywords: + - encode + - media + - tdarr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: tdarr + sources: + - https://github.com/HaveAGitGat/Tdarr + - https://hub.docker.com/r/haveagitgat/tdarr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/tdarr-1.0.30/tdarr-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29758,6 +36151,39 @@ entries: - https://github.com/truecharts/apps/releases/download/tdarr-1.0.23/tdarr-1.0.23.tgz version: 1.0.23 tdarr-node: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.00.12 + created: "2021-12-21T18:46:19.194621308Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Audio/Video library transcoding automation + digest: 0e39d3b10a59c1b1d58dc2ad62cc78b0cdcaa53f7beaf3801c0d3ba5995fc4aa + home: https://github.com/truecharts/apps/tree/master/charts/stable/tdarr-node + icon: https://truecharts.org/_static/img/appicons/tdarr-node-icon.png + keywords: + - encode + - media + - tdarr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: tdarr-node + sources: + - https://github.com/HaveAGitGat/Tdarr + - https://hub.docker.com/r/haveagitgat/tdarr_node + type: application + urls: + - https://github.com/truecharts/apps/releases/download/tdarr-node-1.0.30/tdarr-node-1.0.30.tgz + version: 1.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -29924,6 +36350,40 @@ entries: - https://github.com/truecharts/apps/releases/download/tdarr-node-1.0.23/tdarr-node-1.0.23.tgz version: 1.0.23 teamspeak3: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - voice + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.13.6 + created: "2021-12-21T18:46:19.341903394Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: TeamSpeak is software for quality voice communication via the Internet. + digest: 38ce363ca59321367c592657ad707527b7d38c05b07aa9046abbbfab80511446 + home: https://github.com/truecharts/apps/tree/master/charts/stable/teamspeak3 + icon: https://truecharts.org/_static/img/appicons/teamspeak3-icon.png + keywords: + - voice server + - teamspeak + - teamspeak3 + - teamspeak server + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: teamspeak3 + sources: + - https://hub.docker.com/_/teamspeak + - https://www.teamspeak.com/en/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/teamspeak3-2.0.26/teamspeak3-2.0.26.tgz + version: 2.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30027,6 +36487,43 @@ entries: - https://github.com/truecharts/apps/releases/download/teamspeak3-2.0.21/teamspeak3-2.0.21.tgz version: 2.0.21 teedy: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "1.9" + created: "2021-12-21T18:46:19.525313192Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Teedy is an open source, lightweight document management system for + individuals and businesses. + digest: 3a1ce627c087fbcf3350bdc48f6f0218f2b57f7d98ad87375bd90ffb3105378a + home: https://github.com/truecharts/apps/tree/master/charts/stable/teedy + icon: https://truecharts.org/_static/img/appicons/teedy-icon.png + keywords: + - teedy + - documents + - management + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: teedy + sources: + - https://github.com/sismics/docs + - https://github.com/truecharts/apps/tree/master/charts/teedy + urls: + - https://github.com/truecharts/apps/releases/download/teedy-4.0.17/teedy-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30139,6 +36636,39 @@ entries: - https://github.com/truecharts/apps/releases/download/teedy-4.0.12/teedy-4.0.12.tgz version: 4.0.12 thelounge: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - utilities + truecharts.org/grade: U + apiVersion: v2 + appVersion: 4.3.0 + created: "2021-12-21T18:46:19.669985742Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: The Lounge, modern web IRC client designed for self-hosting + digest: e5f825f0573e0f77a038e3677f4ccbfd1a3af2086e187bf3a51ff11eed1df9c3 + home: https://github.com/truecharts/apps/tree/master/charts/stable/thelounge + icon: https://truecharts.org/_static/img/appicons/thelounge-icon.png + keywords: + - thelounge + - IRC + - The Lounge + - docker + - thelounge-docker + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: thelounge + sources: + - https://github.com/thelounge/thelounge + urls: + - https://github.com/truecharts/apps/releases/download/thelounge-4.0.28/thelounge-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30272,6 +36802,41 @@ entries: - https://github.com/truecharts/apps/releases/download/thelounge-4.0.21/thelounge-4.0.21.tgz version: 4.0.21 traccar: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "4.14" + created: "2021-12-21T18:46:19.832929542Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Traccar is an open source GPS tracking system. + digest: 4ec151d0ccff7d09d4e52363deaa710354f271981632d7c853b4e434ca4e7173 + home: https://github.com/truecharts/apps/tree/master/charts/stable/traccar + icon: https://truecharts.org/_static/img/appicons/traccar-icon.png + keywords: + - traccar + - gps + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: traccar + sources: + - https://github.com/traccar/traccar + - https://hub.docker.com/r/traccar/traccar + urls: + - https://github.com/truecharts/apps/releases/download/traccar-4.0.17/traccar-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30378,6 +36943,39 @@ entries: - https://github.com/truecharts/apps/releases/download/traccar-4.0.12/traccar-4.0.12.tgz version: 4.0.12 traefik: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - network + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.5.5 + created: "2021-12-21T18:46:19.978549669Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Test App for Traefik + digest: d4d2c02d2c936f9392a637cbfed00885a33ab9f088fef05d0abcd738b413fac5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/traefik + icon: https://truecharts.org/_static/img/appicons/traefik-icon.png + keywords: + - traefik + - ingress + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: traefik + sources: + - https://github.com/traefik/traefik + - https://github.com/traefik/traefik-helm-chart + - https://traefik.io/ + type: application + urls: + - https://github.com/truecharts/apps/releases/download/traefik-10.0.29/traefik-10.0.29.tgz + version: 10.0.29 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30511,6 +37109,39 @@ entries: - https://github.com/truecharts/apps/releases/download/traefik-10.0.24/traefik-10.0.24.tgz version: 10.0.24 transmission: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - download-tools + truecharts.org/grade: U + apiVersion: v2 + appVersion: "3.00" + created: "2021-12-21T18:46:20.129362367Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: API Support for your favorite torrent trackers. + digest: 92adbc312a1af993cf5a75a4863bd89c37ce6fae8302d89f6424d555df5fdefd + home: https://github.com/truecharts/apps/tree/master/charts/stable/transmission + icon: https://truecharts.org/_static/img/appicons/transmission-icon.png + keywords: + - transmission + - torrent + - usenet + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: transmission + sources: + - https://github.com/transmission/transmission + - https://hub.docker.com/r/linuxserver/transmission + type: application + urls: + - https://github.com/truecharts/apps/releases/download/transmission-10.0.7/transmission-10.0.7.tgz + version: 10.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30644,6 +37275,36 @@ entries: - https://github.com/truecharts/apps/releases/download/transmission-10.0.0/transmission-10.0.0.tgz version: 10.0.0 truecommand: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - Administration + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.0.2 + created: "2021-12-21T18:46:20.302970106Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Aggregated management of TrueNAS devices + digest: 9179583817c6289126492a44414202e0dbd437e7d7399c85fe5ee28fa5cc1d6a + home: https://github.com/truecharts/apps/tree/master/charts/stable/truecommand + icon: https://truecharts.org/_static/img/appicons/truecommand-icon.png + keywords: + - truecommand + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: truecommand + sources: + - https://hub.docker.com/r/ixsystems/truecommand + type: application + urls: + - https://github.com/truecharts/apps/releases/download/truecommand-9.0.27/truecommand-9.0.27.tgz + version: 9.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -30765,6 +37426,40 @@ entries: - https://github.com/truecharts/apps/releases/download/truecommand-9.0.20/truecommand-9.0.20.tgz version: 9.0.20 tt-rss: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.9082.0 + created: "2021-12-21T18:46:20.476025459Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Tiny Tiny RSS is a free and open source web-based news feed (RSS/Atom) + reader and aggregator + digest: 02baf1ac84f98f33e9b53b9642d5ef9b130e5687564bf3681e1c1403660c78bd + home: https://github.com/truecharts/apps/tree/master/charts/stable/tt-rss + icon: https://truecharts.org/_static/img/appicons/tt-rss-icon.png + keywords: + - tt-rss + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: tt-rss + sources: + - https://git.tt-rss.org/fox/tt-rss + urls: + - https://github.com/truecharts/apps/releases/download/tt-rss-4.0.26/tt-rss-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31004,6 +37699,39 @@ entries: - https://github.com/truecharts/apps/releases/download/tt-rss-4.0.15/tt-rss-4.0.15.tgz version: 4.0.15 tvheadend: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: "63784405" + created: "2021-12-21T18:46:20.627677337Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: TVheadend - a TV streaming server and digital video recorder + digest: dabfd6dbf165a3f93392b73fb1c006cecebf0ff5f03370e30f784f4a81e73d6c + home: https://github.com/truecharts/apps/tree/master/charts/stable/tvheadend + icon: https://truecharts.org/_static/img/appicons/tvheadend-icon.png + keywords: + - tvheadend + - tv + - streaming + - dvb + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: tvheadend + sources: + - https://github.com/tvheadend/tvheadend + type: application + urls: + - https://github.com/truecharts/apps/releases/download/tvheadend-10.0.26/tvheadend-10.0.26.tgz + version: 10.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31104,6 +37832,41 @@ entries: - https://github.com/truecharts/apps/releases/download/tvheadend-10.0.21/tvheadend-10.0.21.tgz version: 10.0.21 twtxt: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.1.1 + created: "2021-12-21T18:46:20.767385108Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A Self-Hosted, Twitter™-like Decentralised microBlogging platform. + No ads, no tracking, your content, your data! + digest: cbc5eacd6538f8fed4c4a62240bc11610379701c4dd92ff7f460ef086bfa93a5 + home: https://github.com/truecharts/apps/tree/master/charts/stable/twtxt + icon: https://truecharts.org/_static/img/appicons/twtxt-icon.png + keywords: + - twtxt + - blogging + - blog + - social-network + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: twtxt + sources: + - https://github.com/prologic/twtxt + - https://github.com/nicholaswilde/docker-twtxt + type: application + urls: + - https://github.com/truecharts/apps/releases/download/twtxt-1.0.26/twtxt-1.0.26.tgz + version: 1.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31210,6 +37973,37 @@ entries: - https://github.com/truecharts/apps/releases/download/twtxt-1.0.21/twtxt-1.0.21.tgz version: 1.0.21 ubooquity: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.2 + created: "2021-12-21T18:46:20.920444452Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Ubooquity is a free, lightweight and easy-to-use home server for + your comics and ebooks. + digest: 17f23307da68d339391083f6738f6dbd723274826f83229ce64271597643c5ce + home: https://github.com/truecharts/apps/tree/master/charts/stable/ubooquity + icon: https://truecharts.org/_static/img/appicons/ubooquity-icon.png + keywords: + - ubooquity + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: ubooquity + sources: + - https://hub.docker.com/r/linuxserver/ubooquity + type: application + urls: + - https://github.com/truecharts/apps/releases/download/ubooquity-0.0.7/ubooquity-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31335,6 +38129,38 @@ entries: - https://github.com/truecharts/apps/releases/download/ubooquity-0.0.1/ubooquity-0.0.1.tgz version: 0.0.1 unifi: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - Networking + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.5.55 + created: "2021-12-21T18:46:21.06352304Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Ubiquiti Network's Unifi Controller + digest: a87cc6454ae22f5e97e55d539ad090b9c4c83ab0cc83e7a1e9e900dddffe2990 + home: https://github.com/truecharts/apps/tree/master/charts/stable/unifi + icon: https://truecharts.org/_static/img/appicons/unifi-icon.png + keywords: + - ubiquiti + - unifi + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: unifi + sources: + - https://github.com/jacobalberty/unifi-docker + - https://unifi-network.ui.com + type: application + urls: + - https://github.com/truecharts/apps/releases/download/unifi-9.0.30/unifi-9.0.30.tgz + version: 9.0.30 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31560,6 +38386,43 @@ entries: - https://github.com/truecharts/apps/releases/download/unifi-9.0.20/unifi-9.0.20.tgz version: 9.0.20 unpackerr: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.9.9 + created: "2021-12-21T18:46:21.247260131Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: This application runs as a daemon on your download host. It checks + for completed downloads and extracts them so Radarr, Lidarr, Sonarr, and Readarr + may import them + digest: a50139cfa6662190ee22c429fe9da11203fbb3c6ad09eb5d63195d7ab2c35df1 + home: https://github.com/truecharts/apps/tree/master/charts/stable/unpackrr + icon: https://truecharts.org/_static/img/appicons/unpackerr-icon.png + keywords: + - unpackerr + - sonarr + - radarr + - lidarr + - readarr + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: unpackerr + sources: + - https://github.com/davidnewhall/unpackerr + - https://hub.docker.com/r/golift/unpackerr + type: application + urls: + - https://github.com/truecharts/apps/releases/download/unpackerr-4.0.28/unpackerr-4.0.28.tgz + version: 4.0.28 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31746,6 +38609,40 @@ entries: - https://github.com/truecharts/apps/releases/download/unpackerr-4.0.20/unpackerr-4.0.20.tgz version: 4.0.20 unpoller: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.1.3 + created: "2021-12-21T18:46:21.399358298Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Collect ALL UniFi Controller, Site, Device & Client Data - Export + to InfluxDB or Prometheus + digest: 7301494ed7eff2af81b82f1cf4bfd81578bc617757d5b036fd6936dc51c6fd41 + home: https://github.com/k8s-at-home/charts/tree/master/charts/stable/unifi-poller + icon: https://truecharts.org/_static/img/appicons/unpoller-icon.png + keywords: + - unifi + - unifi-poller + - metrics + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: unpoller + sources: + - https://github.com/unifi-poller/unifi-poller + - https://hub.docker.com/r/golift/unifi-poller + type: application + urls: + - https://github.com/truecharts/apps/releases/download/unpoller-1.0.18/unpoller-1.0.18.tgz + version: 1.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31883,6 +38780,37 @@ entries: - https://github.com/truecharts/apps/releases/download/unpoller-1.0.12/unpoller-1.0.12.tgz version: 1.0.12 uptime-kuma: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - monitoring + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.10.2 + created: "2021-12-21T18:46:21.560148252Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A fancy self-hosted monitoring tool + digest: f70dab2a9b7b67c24a10df54346b86b45c40e97b348e93f4a1568fb5fe267a5b + home: https://github.com/louislam/uptime-kuma + icon: https://truecharts.org/_static/img/appicons/uptime-kuma-icon.png + keywords: + - monitoring + - uptime + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: uptime-kuma + sources: + - https://github.com/louislam/uptime-kuma + type: application + urls: + - https://github.com/truecharts/apps/releases/download/uptime-kuma-1.0.27/uptime-kuma-1.0.27.tgz + version: 1.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -31977,6 +38905,40 @@ entries: - https://github.com/truecharts/apps/releases/download/uptime-kuma-1.0.22/uptime-kuma-1.0.22.tgz version: 1.0.22 uptimerobot-prometheus: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - metrics + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.0.1 + created: "2021-12-21T18:46:21.721525091Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Prometheus Exporter for the official uptimerobot CLI + digest: 275897dbf2ba2502de051657b79b6eee7be22e8220f4c82bcb714f2e6741f988 + home: https://github.com/k8s-at-home/charts/tree/master/charts/stable/uptimerobot-prometheus + icon: https://truecharts.org/_static/img/appicons/uptimerobot-prometheus-icon.png + keywords: + - uptimerobot + - prometheus + - grafana + - metrics + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: uptimerobot-prometheus + sources: + - https://github.com/lekpamartin/uptimerobot_exporter + - https://github.com/k8s-at-home/charts/tree/master/charts/uptimerobot-prometheus + type: application + urls: + - https://github.com/truecharts/apps/releases/download/uptimerobot-prometheus-2.0.7/uptimerobot-prometheus-2.0.7.tgz + version: 2.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32114,6 +39076,37 @@ entries: - https://github.com/truecharts/apps/releases/download/uptimerobot-prometheus-2.0.0/uptimerobot-prometheus-2.0.0.tgz version: 2.0.0 valheim: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: latest + created: "2021-12-21T18:46:21.882007053Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Valheim dedicated gameserver with automatic update and world backup + support + digest: 8a7afe8ac46ad52b8eeeaa7d2857d30ef14a1c03e4a9fdbfc9343d306b5eb0a8 + home: https://github.com/truecharts/apps/tree/master/charts/stable/valheim + icon: https://truecharts.org/_static/img/appicons/valheim-icon.png + keywords: + - valheim + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: valheim + sources: + - https://github.com/lloesche/valheim-server-docker + - https://hub.docker.com/r/lloesche/valheim-server + urls: + - https://github.com/truecharts/apps/releases/download/valheim-2.0.7/valheim-2.0.7.tgz + version: 2.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32239,6 +39232,45 @@ entries: - https://github.com/truecharts/apps/releases/download/valheim-2.0.0/valheim-2.0.0.tgz version: 2.0.0 vaultwarden: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - security + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.23.1 + created: "2021-12-21T18:46:22.035889776Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Unofficial Bitwarden compatible server written in Rust + digest: b5a005704703fa8c155d7af1537ff5c956928f1218e25ec90b43a608018102cb + home: https://github.com/truecharts/apps/tree/master/charts/stable/vaultwarden + icon: https://truecharts.org/_static/img/appicons/vaultwarden-icon.png + keywords: + - bitwarden + - bitwardenrs + - bitwarden_rs + - vaultwarden + - password + - rust + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: vaultwarden + sources: + - https://github.com/dani-garcia/vaultwarden + type: application + urls: + - https://github.com/truecharts/apps/releases/download/vaultwarden-13.0.18/vaultwarden-13.0.18.tgz + version: 13.0.18 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32396,6 +39428,36 @@ entries: - https://github.com/truecharts/apps/releases/download/vaultwarden-13.0.11/vaultwarden-13.0.11.tgz version: 13.0.11 webgrabplus: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.2.2 + created: "2021-12-21T18:46:22.735043317Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Webgrabplus is a multi-site incremental xmltv epg grabber. + digest: 1219788128fe25457e6cb693544e3798c4975870b4c7237d4ab038b93f542ae9 + home: https://github.com/truecharts/apps/tree/master/charts/stable/webgrabplus + icon: https://truecharts.org/_static/img/appicons/webgrabplus-icon.png + keywords: + - webgrabplus + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: webgrabplus + sources: + - https://hub.docker.com/r/linuxserver/webgrabplus + type: application + urls: + - https://github.com/truecharts/apps/releases/download/webgrabplus-0.0.8/webgrabplus-0.0.8.tgz + version: 0.0.8 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32547,6 +39609,38 @@ entries: - https://github.com/truecharts/apps/releases/download/webgrabplus-0.0.1/webgrabplus-0.0.1.tgz version: 0.0.1 whoogle: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 0.7.0 + created: "2021-12-21T18:46:22.886035111Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: A self-hosted, ad-free, privacy-respecting metasearch engine + digest: 79834442a6d85d01ef43c8ed04f474e52d2a397aeb6c0c03d5d6a9f0afe12c70 + home: https://github.com/truecharts/apps/tree/master/charts/stable/whoogle + icon: https://truecharts.org/_static/img/appicons/whoogle-icon.png + keywords: + - whoogle + - search + - open source + - privacy + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: whoogle + sources: + - https://github.com/benbusby/whoogle-search + urls: + - https://github.com/truecharts/apps/releases/download/whoogle-1.0.27/whoogle-1.0.27.tgz + version: 1.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32644,6 +39738,42 @@ entries: - https://github.com/truecharts/apps/releases/download/whoogle-1.0.21/whoogle-1.0.21.tgz version: 1.0.21 wikijs: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.5.260 + created: "2021-12-21T18:46:23.047909938Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: postgresql.enabled + name: postgresql + repository: https://truecharts.org/ + version: 6.0.37 + description: Make documentation a joy to write using Wiki.js's beautiful and intuitive + interface! + digest: b0317e8fc2af18a7d214b8c0aff73790366be0501b47f4f34a90b6405051e9ae + home: https://github.com/truecharts/apps/tree/master/charts/stable/wikijs + icon: https://truecharts.org/_static/img/appicons/wikijs-icon.png + keywords: + - wiki + - wikijs + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: wikijs + sources: + - https://hub.docker.com/r/linuxserver/wikijs/ + - https://github.com/Requarks/wiki + urls: + - https://github.com/truecharts/apps/releases/download/wikijs-4.0.17/wikijs-4.0.17.tgz + version: 4.0.17 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32753,6 +39883,37 @@ entries: - https://github.com/truecharts/apps/releases/download/wikijs-4.0.11/wikijs-4.0.11.tgz version: 4.0.11 wireshark: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.4.5 + created: "2021-12-21T18:46:23.193174073Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Wireshark is the world’s foremost and widely-used network protocol + analyzer. + digest: b47155d8ea3a25d2ff8ae1356f9ecf307ccdf829c5dcc1adc31f745476c1b2b7 + home: https://github.com/truecharts/apps/tree/master/charts/stable/wireshark + icon: https://truecharts.org/_static/img/appicons/wireshark-icon.png + keywords: + - wireshark + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: wireshark + sources: + - https://hub.docker.com/r/linuxserver/wireshark + type: application + urls: + - https://github.com/truecharts/apps/releases/download/wireshark-0.0.7/wireshark-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32878,6 +40039,41 @@ entries: - https://github.com/truecharts/apps/releases/download/wireshark-0.0.1/wireshark-0.0.1.tgz version: 0.0.1 xbackbone: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - files + truecharts.org/grade: U + apiVersion: v2 + appVersion: 3.3.3 + created: "2021-12-21T18:46:23.348062072Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + - condition: mariadb.enabled + name: mariadb + repository: https://truecharts.org/ + version: 1.0.40 + description: XBackBone is a simple, self-hosted, lightweight PHP file manager + digest: 72b00e8f779e7b8fb1482a190db7d3240ce3b65b09fa096c760b8e7c91080816 + home: https://github.com/truechartsapps/tree/master/charts/stable/xbackbone + icon: https://truecharts.org/_static/img/appicons/xbackbone-icon.png + keywords: + - xbackbone + - xshare + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: xbackbone + sources: + - https://github.com/SergiX44/XBackBone + - https://hub.docker.com/r/pe46dro/xbackbone-docker + urls: + - https://github.com/truecharts/apps/releases/download/xbackbone-0.0.15/xbackbone-0.0.15.tgz + version: 0.0.15 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -32984,6 +40180,39 @@ entries: - https://github.com/truecharts/apps/releases/download/xbackbone-0.0.10/xbackbone-0.0.10.tgz version: 0.0.10 xteve: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 2.2.0.200 + created: "2021-12-21T18:46:23.509106819Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: M3U Proxy for Plex DVR and Emby Live TV. + digest: 83fe1fa9f24d432ad309033cd6823a859ed1308a0da04bc2c1b5212841cff7ef + home: https://github.com/truechartsapps/tree/master/charts/stable/xteve + icon: https://truecharts.org/_static/img/appicons/xteve-icon.png + keywords: + - xteve + - iptv + - plex + - emby + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: xteve + sources: + - https://github.com/xteve-project/xTeVe + - https://github.com/k8s-at-home/container-images + urls: + - https://github.com/truecharts/apps/releases/download/xteve-4.0.26/xteve-4.0.26.tgz + version: 4.0.26 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -33084,6 +40313,38 @@ entries: - https://github.com/truecharts/apps/releases/download/xteve-4.0.21/xteve-4.0.21.tgz version: 4.0.21 zigbee2mqtt: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - media + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.22.1 + created: "2021-12-21T18:46:23.675553434Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Bridges events and allows you to control your Zigbee devices via + MQTT + digest: caefc843bee8be9a8a156797e23395d8418306ed133b5ae5ca65c096721ebf79 + home: https://github.com/truecharts/apps/tree/master/charts/stable/zigbee2mqtt + icon: https://truecharts.org/_static/img/appicons/zigbee2mqtt-icon.png + keywords: + - zigbee + - mqtt + - home-assistant + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: zigbee2mqtt + sources: + - https://github.com/Koenkk/zigbee2mqtt + urls: + - https://github.com/truecharts/apps/releases/download/zigbee2mqtt-1.0.27/zigbee2mqtt-1.0.27.tgz + version: 1.0.27 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -33181,6 +40442,37 @@ entries: - https://github.com/truecharts/apps/releases/download/zigbee2mqtt-1.0.22/zigbee2mqtt-1.0.22.tgz version: 1.0.22 znc: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - incubator + truecharts.org/grade: U + apiVersion: v2 + appVersion: 1.8.2 + created: "2021-12-21T18:46:23.821256858Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Znc is an IRC network bouncer or BNC. It can detach the client from + the actual IRC server, and also from selected channels. + digest: f20559867b9f8b6a0f4a806938c5d41ff513f8b7e0f269636495125f8c38ab9f + home: https://github.com/truecharts/apps/tree/master/charts/stable/znc + icon: https://truecharts.org/_static/img/appicons/znc-icon.png + keywords: + - znc + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: znc + sources: + - https://hub.docker.com/r/linuxserver/znc + type: application + urls: + - https://github.com/truecharts/apps/releases/download/znc-0.0.7/znc-0.0.7.tgz + version: 0.0.7 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -33306,6 +40598,41 @@ entries: - https://github.com/truecharts/apps/releases/download/znc-0.0.1/znc-0.0.1.tgz version: 0.0.1 zwavejs2mqtt: + - annotations: + truecharts.org/SCALE-support: "true" + truecharts.org/catagories: | + - tools + truecharts.org/grade: U + apiVersion: v2 + appVersion: 6.1.1 + created: "2021-12-21T18:46:23.97276584Z" + dependencies: + - name: common + repository: https://truecharts.org + version: 8.9.25 + description: Fully configurable Zwave to MQTT gateway and Control Panel using + NodeJS and Vue + digest: 69addc32a4f217fa3d8ba61d352e79cb1671782b9d8232afac2179e3afa7191e + home: https://github.com/truecharts/apps/tree/master/charts/stable/zwavejs2mqtt + icon: https://truecharts.org/_static/img/appicons/zwavejs2mqtt-icon.png + keywords: + - zwavejs2mqtt + - zwave-js + - z-wave + - zwave + kubeVersion: '>=1.16.0-0' + maintainers: + - email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org + name: zwavejs2mqtt + sources: + - https://github.com/zwave-js/zwavejs2mqtt + - https://hub.docker.com/r/zwavejs/zwavejs2mqtt + type: application + urls: + - https://github.com/truecharts/apps/releases/download/zwavejs2mqtt-9.0.33/zwavejs2mqtt-9.0.33.tgz + version: 9.0.33 - annotations: truecharts.org/SCALE-support: "true" truecharts.org/catagories: | @@ -33481,4 +40808,4 @@ entries: urls: - https://github.com/truecharts/apps/releases/download/zwavejs2mqtt-9.0.24/zwavejs2mqtt-9.0.24.tgz version: 9.0.24 -generated: "2021-12-21T14:35:46.989485361Z" +generated: "2021-12-21T18:46:23.975987061Z"