From 8cc16841ff3126ca40761c21bd74caa056970d9b Mon Sep 17 00:00:00 2001 From: Vincent Date: Tue, 13 Feb 2024 12:24:53 +0000 Subject: [PATCH] add 5.3.0 image scan (#8579) Publish vulnerability justifications for 5.3.0 release. --- content/departments/security/tooling/trivy/5-3-0.md | 13 +++++++++++++ content/departments/security/tooling/trivy/index.md | 4 ++++ 2 files changed, 17 insertions(+) create mode 100644 content/departments/security/tooling/trivy/5-3-0.md diff --git a/content/departments/security/tooling/trivy/5-3-0.md b/content/departments/security/tooling/trivy/5-3-0.md new file mode 100644 index 000000000000..6184c70d84f8 --- /dev/null +++ b/content/departments/security/tooling/trivy/5-3-0.md @@ -0,0 +1,13 @@ +# Accepted CVEs for Sourcegraph 5.3.0 + +| CVE ID | Affected Images | CVE Severity | CVSS Base Score | [Sourcegraph Assessment](../../../engineering/dev/policies/vulnerability-management-policy.md#severity-levels) | CVSS Environmental Score | Details | +| ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | --------------- | -------------------------------------------------------------------------------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) | sourcegraph/executor, sourcegraph/bundled-executor, sourcegraph/executor-kubernetes, sourcegraph/dind | High | 7.5 | Medium | 4.7 | The services that are vulnerable to this issue are typically not exposed on the internet. The likelihood of exploitation is low and this does not have a significant impact on the security of the instance. The issue is not present in Sourcegraph itself. | +| [GHSA-M425-MQ94-257G](https://github.com/grpc/grpc-go) | sourcegraph/executor-kubernetes, sourcegraph/dind, sourcegraph/executor, sourcegraph/bundled-executor, sourcegraph/executor-kubernetes, sourcegraph/dind, sourcegraph/executor, sourcegraph/bundled-executor | High | 7.5 | Medium | 4.7 | The services that are vulnerable to this issue are typically not exposed on the internet. The likelihood of exploitation is low and this does not have a significant impact on the security of the instance. The issue is not present in Sourcegraph itself. | +| [CVE-2023-47108](https://access.redhat.com/security/cve/CVE-2023-47108) | sourcegraph/dind | High | 7.5 | Info | 0 | This workload is not exposed and cannot be reached over the internet. This image is not part of standard deployments. | +| [CVE-2023-45142](https://access.redhat.com/security/cve/CVE-2023-45142) | sourcegraph/dind | High | 7.5 | Info | 0 | This workload is not exposed and cannot be reached over the internet. This image is not part of standard deployments. | +| [CVE-2023-7104](https://access.redhat.com/errata/RHSA-2024:0465) | sourcegraph/codeinsights-db, sourcegraph/codeintel-db, sourcegraph/postgres-12-alpine | High | 7.3 | Medium | 4.1 | This is not exploitable over the internet. It would require an actor to write very specific SQLITE queries which is not possible in the default configuration. | +| [CVE-2024-23652](https://access.redhat.com/security/cve/CVE-2024-23652) | sourcegraph/dind | Critical | 7.4 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. | +| [CVE-2024-23653](https://access.redhat.com/security/cve/CVE-2024-23653) | sourcegraph/dind | Critical | 9.8 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. | +| [CVE-2024-23651](https://access.redhat.com/security/cve/CVE-2024-23651) | sourcegraph/dind | High | 7.4 | Info | 0 | We are not vulnerable for this issue as it requires access to our underlying infrastructure for exploitation. An actor cannot use this to gain access to our instances. | +| [CVE-2024-21626](http://packetstormsecurity.com/files/176993/runc-1.1.11-File-Descriptor-Leak-Privilege-Escalation.html) | sourcegraph/dind | High | 8.6 | High | 8.6 | Dind is used for Kubernetes executors and is not part of the standard deployment. This issue is not fixed in the latest dind release, and we will upgrade once a patch is available. | diff --git a/content/departments/security/tooling/trivy/index.md b/content/departments/security/tooling/trivy/index.md index dfd2faae643a..20958d9460b7 100644 --- a/content/departments/security/tooling/trivy/index.md +++ b/content/departments/security/tooling/trivy/index.md @@ -116,6 +116,10 @@ Releases of Sourcegraph may ship with container images that contain known vulner packages that are either false positives considering the way in which we run Sourcegraph, or that we have accepted as low risk. You can find more details about these below: +### 5.3 + +- [5.3.0](./5-3-0.md) + ### 5.2 - [5.2.7](./5-2-7.md)