Skip to content
This repository has been archived by the owner on Jul 2, 2024. It is now read-only.

Commit

Permalink
add 5.3.0 image scan (#8579)
Browse files Browse the repository at this point in the history 
Publish vulnerability justifications for 5.3.0 release.
  • Loading branch information
@evict
evict authored Feb 13, 2024
1 parent 88c7379 commit 8cc1684
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 0 deletions.
13 changes: 13 additions & 0 deletions content/departments/security/tooling/trivy/5-3-0.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Accepted CVEs for Sourcegraph 5.3.0

| CVE ID | Affected Images | CVE Severity | CVSS Base Score | [Sourcegraph Assessment](../../../engineering/dev/policies/vulnerability-management-policy.md#severity-levels) | CVSS Environmental Score | Details |
| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | --------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) | sourcegraph/executor, sourcegraph/bundled-executor, sourcegraph/executor-kubernetes, sourcegraph/dind | High | 7.5 | Medium | 4.7 | The services that are vulnerable to this issue are typically not exposed on the internet. The likelihood of exploitation is low and this does not have a significant impact on the security of the instance. The issue is not present in Sourcegraph itself. |
| [GHSA-M425-MQ94-257G](https://github.com/grpc/grpc-go) | sourcegraph/executor-kubernetes, sourcegraph/dind, sourcegraph/executor, sourcegraph/bundled-executor, sourcegraph/executor-kubernetes, sourcegraph/dind, sourcegraph/executor, sourcegraph/bundled-executor | High | 7.5 | Medium | 4.7 | The services that are vulnerable to this issue are typically not exposed on the internet. The likelihood of exploitation is low and this does not have a significant impact on the security of the instance. The issue is not present in Sourcegraph itself. |
| [CVE-2023-47108](https://access.redhat.com/security/cve/CVE-2023-47108) | sourcegraph/dind | High | 7.5 | Info | 0 | This workload is not exposed and cannot be reached over the internet. This image is not part of standard deployments. |
| [CVE-2023-45142](https://access.redhat.com/security/cve/CVE-2023-45142) | sourcegraph/dind | High | 7.5 | Info | 0 | This workload is not exposed and cannot be reached over the internet. This image is not part of standard deployments. |
| [CVE-2023-7104](https://access.redhat.com/errata/RHSA-2024:0465) | sourcegraph/codeinsights-db, sourcegraph/codeintel-db, sourcegraph/postgres-12-alpine | High | 7.3 | Medium | 4.1 | This is not exploitable over the internet. It would require an actor to write very specific SQLITE queries which is not possible in the default configuration. |
| [CVE-2024-23652](https://access.redhat.com/security/cve/CVE-2024-23652) | sourcegraph/dind | Critical | 7.4 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. |
| [CVE-2024-23653](https://access.redhat.com/security/cve/CVE-2024-23653) | sourcegraph/dind | Critical | 9.8 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. |
| [CVE-2024-23651](https://access.redhat.com/security/cve/CVE-2024-23651) | sourcegraph/dind | High | 7.4 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. |
| [CVE-2024-21626](http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html) | sourcegraph/dind | High | 8.6 | High | 8.6 | Dind is used for Kubernetes executors and is not part of the standard deployment. This issue is not fixed in the latest dind release, and we will upgrade once a patch is available. |
4 changes: 4 additions & 0 deletions content/departments/security/tooling/trivy/index.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -116,6 +116,10 @@ Releases of Sourcegraph may ship with container images that contain known vulner
packages that are either false positives considering the way in which we run Sourcegraph,
or that we have accepted as low risk. You can find more details about these below:

### 5.3

- [5.3.0](./5-3-0.md)

### 5.2

- [5.2.7](./5-2-7.md)
Expand Down

0 comments on commit 8cc1684

Please sign in to comment.