Ian Littman
ec06952245
Bump Alpine (to 3.23.3), Go (to 1.25.6) to resolve vulns ( #38973 )
2026-01-28 18:51:15 -06:00
Robert Fairburn
1fedabe7a8
Update alpine base image to latest ( #34864 )
...
Resolves openssl:3.3.3/CVE-2025-9230 in base images.
2025-10-28 11:24:05 -05:00
Lucas Manuel Rodriguez
ae00add76e
Update alpine to patch vulnerability with severity "HIGH" ( #26593 )
...
The vulnerability was posted by a prospect.
Posting manual command until we get #25902 done.
```sh
trivy image --ignore-unfixed --pkg-types os,library --severity CRITICAL,HIGH --show-suppressed fleetdm/fleet:v4.64.1
[...]
fleetdm/fleet:v4.64.1 (alpine 3.21.0)
Total: 2 (HIGH: 2, CRITICAL: 0)
┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ libcrypto3 │ CVE-2024-12797 │ HIGH │ fixed │ 3.3.2-r4 │ 3.3.3-r0 │ openssl: RFC7250 handshakes with unauthenticated servers │
│ │ │ │ │ │ │ don't abort as expected │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-12797 │
├────────────┤ │ │ │ │ │ │
│ libssl3 │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘
```
2025-02-25 18:33:24 -03:00
StepSecurity Bot
80335d88d1
[StepSecurity] Apply security best practices ( #17811 )
2024-03-22 16:19:11 -05:00
Jahziel Villasana-Espinoza
272ce3187f
feat: move scep dependency inside the monorepo ( #16988 )
...
Following the pattern set up by Martin and Lucas for similar PRs. Can be
reviewed by commits:
1. move scep directory into monorepo
2. update import paths
3. update go.mod, go.sum
4. fix golint errors in scep package
5. skip a failing test that's been broken for a while
6. fix that failing test
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Manual QA for all new/changed functionality
Also verified that our test suite runs the `scep` tests.
2024-02-22 13:13:46 -05:00
Ian Littman