Update security status (#37086)
Update our `security/status.md` file after analyzing currently reported vulnerabilities. https://github.com/fleetdm/fleet/actions/runs/20115346825 <img width="1711" height="645" alt="Screenshot 2025-12-10 at 7 41 00 PM" src="https://github.com/user-attachments/assets/97e17b58-50a8-4556-9ceb-bcb6701d7d61" />
This commit is contained in:
Lucas Manuel Rodriguez
@@ -0,0 +1 @@
|
||||
* Switched Fleet logo in macOS Desktop from a PNG to an SVG.
|
||||
@@ -0,0 +1 @@
|
||||
* Updated go to 1.25.5.
|
||||
+4
-2
@@ -11,8 +11,10 @@
|
||||
The following Github CI actions perform daily vulnerability scanning on Fleet software components.
|
||||
|
||||
- [trivy-scan.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/trivy-scan.yml): Scan source code for vulnerabilities.
|
||||
- [build-and-check-fleetctl-docker-and-deps.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in `fleetctl` docker image dependencies (`fleetdm/fleetctl`, `fleetdm/wix`, and `fleetdm/bomutils`).
|
||||
- [goreleaser-snapshot-fleet.yaml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/goreleaser-snapshot-fleet.yaml): Scans for HIGH and CRITICAL vulnerabilities in `fleetdm/fleet` docker image before pushing to the Docker registry (runs daily and is triggered for every change in Fleet's source code).
|
||||
- [build-fleetdm-fleetctl-check-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/build-fleetdm-fleetctl-check-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/fleetctl](https://hub.docker.com/r/fleetdm/fleetctl) docker image.
|
||||
- [check-wix-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-wix-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/wix](https://hub.docker.com/r/fleetdm/wix) docker image. This docker image is used by the `fleetctl` executable to generate MSI fleetd installers.
|
||||
- [check-bomutils-vulnerabilities.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-bomutils-vulnerabilities.yml): Scans for `HIGH` and `CRITICAL` vulnerabilities in [fleetdm/bomutils](https://hub.docker.com/r/fleetdm/bomutils) docker image. This docker image is used by the `fleetctl` executable to generate PKG fleetd installers.
|
||||
- [goreleaser-snapshot-fleet.yaml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/goreleaser-snapshot-fleet.yaml): Scans for `HIGH` and `CRITICAL` vulnerabilities in `fleetdm/fleet` docker image before pushing a new release to the Docker registry.
|
||||
- [check-vulnerabilities-in-released-docker-images.yml](https://github.com/fleetdm/fleet/blob/main/.github/workflows/check-vulnerabilities-in-released-docker-images.yml): Scans for `CRITICAL` vulnerabilities in the last 5 minor released versions of the `fleetdm/fleet` and on the latest release of `fleetdm/fleetctl`.
|
||||
|
||||
## Process to run when a CVE is reported
|
||||
|
||||
@@ -13,6 +13,21 @@ Following is the vulnerability report of Fleet and its dependencies.
|
||||
- **Justification:** `vulnerable_code_not_in_execute_path`
|
||||
- **Timestamp:** 2025-10-01 10:09:03
|
||||
|
||||
### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729)
|
||||
#### Statement:
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `fixed`
|
||||
- **Products:**: `fleet@v4.78.*`
|
||||
- **Timestamp:** 2025-12-10 19:26:25
|
||||
|
||||
#### Statement:
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `affected`
|
||||
- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available.
|
||||
- **Products:**: `fleet@v4.77.0`,`fleet@v4.76.0`,`fleet@v4.76.1`,`fleet@v4.75.0`,`fleet@v4.75.1`,`pkg:golang/stdlib@1.25.3`
|
||||
- **Action statement:** `No action statement provided`
|
||||
- **Timestamp:** 2025-12-10 19:26:10
|
||||
|
||||
### [CVE-2025-46569](https://nvd.nist.gov/vuln/detail/CVE-2025-46569)
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `not_affected`
|
||||
@@ -101,6 +116,53 @@ Following is the vulnerability report of Fleet and its dependencies.
|
||||
|
||||
## `fleetdm/fleetctl` docker image
|
||||
|
||||
### [CVE-2025-66516](https://nvd.nist.gov/vuln/detail/CVE-2025-66516)
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `not_affected`
|
||||
- **Status notes:** fleetdm/fleetctl does not process end-user provided PDF files with Java when generating fleetd installers. The only PDF processing code is in Go for EULA documents.
|
||||
- **Products:**: `fleetctl`,`pkg:maven/org.apache.tika/tika-core`
|
||||
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
|
||||
- **Timestamp:** 2025-12-10 18:12:45
|
||||
|
||||
### [CVE-2025-66293](https://nvd.nist.gov/vuln/detail/CVE-2025-66293)
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `not_affected`
|
||||
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
|
||||
- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16`
|
||||
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
|
||||
- **Timestamp:** 2025-12-10 19:04:58
|
||||
|
||||
### [CVE-2025-65018](https://nvd.nist.gov/vuln/detail/CVE-2025-65018)
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `not_affected`
|
||||
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
|
||||
- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16`
|
||||
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
|
||||
- **Timestamp:** 2025-12-10 19:04:42
|
||||
|
||||
### [CVE-2025-64720](https://nvd.nist.gov/vuln/detail/CVE-2025-64720)
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `not_affected`
|
||||
- **Status notes:** fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing.
|
||||
- **Products:**: `fleetctl`,`pkg:deb/debian/libpng16-16`
|
||||
- **Justification:** `vulnerable_code_cannot_be_controlled_by_adversary`
|
||||
- **Timestamp:** 2025-12-10 19:04:07
|
||||
|
||||
### [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729)
|
||||
#### Statement:
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `fixed`
|
||||
- **Products:**: `fleetctl@v4.78.*`
|
||||
- **Timestamp:** 2025-12-10 19:26:44
|
||||
|
||||
#### Statement:
|
||||
- **Author:** @lucasmrod
|
||||
- **Status:** `affected`
|
||||
- **Status notes:** This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available.
|
||||
- **Products:**: `fleetctl@v4.77.0`,`fleetctl@v4.76.0`,`fleetctl@v4.76.1`,`fleetctl@v4.75.0`,`fleetctl@v4.75.1`,`pkg:golang/stdlib@1.25.3`
|
||||
- **Action statement:** `No action statement provided`
|
||||
- **Timestamp:** 2025-12-10 19:26:35
|
||||
|
||||
### [CVE-2025-49796](https://nvd.nist.gov/vuln/detail/CVE-2025-49796)
|
||||
- **Author:** @sgress454
|
||||
- **Status:** `not_affected`
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-70a31e17085372696de6af69bd69d1fba9afeabb8a1d4f003aeb6b867fa98250",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T19:26:10.114603-03:00",
|
||||
"last_updated": "2025-12-10T19:26:25.983491-03:00",
|
||||
"version": 2,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-61729",
|
||||
"aliases": [
|
||||
"https://pkg.go.dev/vuln/GO-2025-4155"
|
||||
]
|
||||
},
|
||||
"timestamp": "2025-12-10T19:26:10.114604-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleet@v4.77.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleet@v4.76.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleet@v4.76.1"
|
||||
},
|
||||
{
|
||||
"@id": "fleet@v4.75.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleet@v4.75.1"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:golang/stdlib@1.25.3"
|
||||
}
|
||||
],
|
||||
"status": "affected",
|
||||
"status_notes": "This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available",
|
||||
"action_statement": "No action statement provided",
|
||||
"action_statement_timestamp": "2025-12-10T19:26:10.114604-03:00"
|
||||
},
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-61729",
|
||||
"aliases": [
|
||||
"https://pkg.go.dev/vuln/GO-2025-4155"
|
||||
]
|
||||
},
|
||||
"timestamp": "2025-12-10T19:26:25.983491-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleet@v4.78.*"
|
||||
}
|
||||
],
|
||||
"status": "fixed"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-f8c19c3ccf1d0a0d11064148d5f0b464260d62d948c23bd8034664a0a9dfa91d",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T19:26:35.526636-03:00",
|
||||
"last_updated": "2025-12-10T19:26:44.598903-03:00",
|
||||
"version": 2,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-61729",
|
||||
"aliases": [
|
||||
"https://pkg.go.dev/vuln/GO-2025-4155"
|
||||
]
|
||||
},
|
||||
"timestamp": "2025-12-10T19:26:35.526637-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl@v4.77.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleetctl@v4.76.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleetctl@v4.76.1"
|
||||
},
|
||||
{
|
||||
"@id": "fleetctl@v4.75.0"
|
||||
},
|
||||
{
|
||||
"@id": "fleetctl@v4.75.1"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:golang/stdlib@1.25.3"
|
||||
}
|
||||
],
|
||||
"status": "affected",
|
||||
"status_notes": "This is not a CRITICAL CVE, but we still recommend upgrading to 4.78.* when it's available",
|
||||
"action_statement": "No action statement provided",
|
||||
"action_statement_timestamp": "2025-12-10T19:26:35.526637-03:00"
|
||||
},
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-61729",
|
||||
"aliases": [
|
||||
"https://pkg.go.dev/vuln/GO-2025-4155"
|
||||
]
|
||||
},
|
||||
"timestamp": "2025-12-10T19:26:44.598904-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl@v4.78.*"
|
||||
}
|
||||
],
|
||||
"status": "fixed"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-cf7a25c62203c07f3cc0f81ef456cc904ee3030738a7d79197db42c870f2348e",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T19:04:07.17996-03:00",
|
||||
"version": 1,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-64720"
|
||||
},
|
||||
"timestamp": "2025-12-10T19:04:07.17996-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:deb/debian/libpng16-16"
|
||||
}
|
||||
],
|
||||
"status": "not_affected",
|
||||
"status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing",
|
||||
"justification": "vulnerable_code_cannot_be_controlled_by_adversary"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-205287daa41f5f47e114aa1b974930f4188026e04e84d1d2009d64a6b30d7ef8",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T19:04:42.718401-03:00",
|
||||
"version": 1,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-65018"
|
||||
},
|
||||
"timestamp": "2025-12-10T19:04:42.718402-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:deb/debian/libpng16-16"
|
||||
}
|
||||
],
|
||||
"status": "not_affected",
|
||||
"status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing",
|
||||
"justification": "vulnerable_code_cannot_be_controlled_by_adversary"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-9cf22a6de776d8bf4b90f8177d5f22aa878a0e6ecd3616f5863b6739ceece84a",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T19:04:58.902397-03:00",
|
||||
"version": 1,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-66293"
|
||||
},
|
||||
"timestamp": "2025-12-10T19:04:58.902398-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:deb/debian/libpng16-16"
|
||||
}
|
||||
],
|
||||
"status": "not_affected",
|
||||
"status_notes": "fleetdm/fleetctl does not use libpng. Fleet components use the 'image/png' Go package for png processing",
|
||||
"justification": "vulnerable_code_cannot_be_controlled_by_adversary"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
"@context": "https://openvex.dev/ns/v0.2.0",
|
||||
"@id": "https://openvex.dev/docs/public/vex-e83a3bb89b00837be30b188bd3eed874867824a0e4496a329b4e0884beeccb9c",
|
||||
"author": "@lucasmrod",
|
||||
"timestamp": "2025-12-10T18:12:45.166362-03:00",
|
||||
"version": 1,
|
||||
"statements": [
|
||||
{
|
||||
"vulnerability": {
|
||||
"name": "CVE-2025-66516"
|
||||
},
|
||||
"timestamp": "2025-12-10T18:12:45.166363-03:00",
|
||||
"products": [
|
||||
{
|
||||
"@id": "fleetctl"
|
||||
},
|
||||
{
|
||||
"@id": "pkg:maven/org.apache.tika/tika-core"
|
||||
}
|
||||
],
|
||||
"status": "not_affected",
|
||||
"status_notes": "fleetdm/fleetctl does not process end-user provided PDF files with Java when generating fleetd installers. The only PDF processing code is in Go for EULA documents.",
|
||||
"justification": "vulnerable_code_cannot_be_controlled_by_adversary"
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user