TrueChartsClone/charts/stable/overseerr/security.md

hide
toc

Security Overview

Helm-Chart

Scan Results

Chart Object: overseerr/templates/common.yaml

Type	Misconfiguration ID	Check	Severity	Explaination	Links
Kubernetes Security Check	KSV001	Process can elevate its own privileges	MEDIUM	Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.allowPrivilegeEscalation' to false	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv001
Kubernetes Security Check	KSV001	Process can elevate its own privileges	MEDIUM	Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.allowPrivilegeEscalation' to false	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv001
Kubernetes Security Check	KSV003	Default capabilities not dropped	LOW	Expand... The container should drop all default capabilities and add only those that are needed for its execution. Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should add 'ALL' to 'securityContext.capabilities.drop'	Expand... https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/ https://avd.aquasec.com/misconfig/ksv003
Kubernetes Security Check	KSV003	Default capabilities not dropped	LOW	Expand... The container should drop all default capabilities and add only those that are needed for its execution. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should add 'ALL' to 'securityContext.capabilities.drop'	Expand... https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/ https://avd.aquasec.com/misconfig/ksv003
Kubernetes Security Check	KSV012	Runs as root user	MEDIUM	Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsNonRoot' to true	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv012
Kubernetes Security Check	KSV014	Root file system is not read-only	LOW	Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true	Expand... https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/ https://avd.aquasec.com/misconfig/ksv014
Kubernetes Security Check	KSV014	Root file system is not read-only	LOW	Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.readOnlyRootFilesystem' to true	Expand... https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/ https://avd.aquasec.com/misconfig/ksv014
Kubernetes Security Check	KSV017	Privileged container	HIGH	Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.privileged' to false	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline https://avd.aquasec.com/misconfig/ksv017
Kubernetes Security Check	KSV020	Runs with low user ID	LOW	Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000	Expand... https://kubesec.io/basics/containers-securitycontext-runasuser/ https://avd.aquasec.com/misconfig/ksv020
Kubernetes Security Check	KSV020	Runs with low user ID	LOW	Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsUser' > 10000	Expand... https://kubesec.io/basics/containers-securitycontext-runasuser/ https://avd.aquasec.com/misconfig/ksv020
Kubernetes Security Check	KSV021	Runs with low group ID	LOW	Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. Container 'RELEASE-NAME-overseerr' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000	Expand... https://kubesec.io/basics/containers-securitycontext-runasuser/ https://avd.aquasec.com/misconfig/ksv021
Kubernetes Security Check	KSV021	Runs with low group ID	LOW	Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. Container 'autopermissions' of Deployment 'RELEASE-NAME-overseerr' should set 'securityContext.runAsGroup' > 10000	Expand... https://kubesec.io/basics/containers-securitycontext-runasuser/ https://avd.aquasec.com/misconfig/ksv021
Kubernetes Security Check	KSV030	Default Seccomp profile not set	LOW	Expand... The RuntimeDefault/Localhost seccomp profile must be required, or allow specific additional profiles. Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv030
Kubernetes Security Check	KSV030	Default Seccomp profile not set	LOW	Expand... The RuntimeDefault/Localhost seccomp profile must be required, or allow specific additional profiles. Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv030
Kubernetes Security Check	KSV105	Containers must not set runAsUser to 0	LOW	Expand... Containers should be forbidden from running with a root UID. securityContext.runAsUser should be set to a value greater than 0	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv105
Kubernetes Security Check	KSV106	Container capabilities must only include NET_BIND_SERVICE	LOW	Expand... Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability. container should drop all	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv106
Kubernetes Security Check	KSV106	Container capabilities must only include NET_BIND_SERVICE	LOW	Expand... Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability. container should drop all	Expand... https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted https://avd.aquasec.com/misconfig/ksv106

Containers

Detected Containers

      tccr.io/truecharts/alpine:v3.16.0@sha256:16dc15f3d61a1e30b1df9f839e53636847b6097286b2b74c637b25fd8264f730
      tccr.io/truecharts/overseerr:v1.29.1@sha256:8b2e31f80dcdaed42ef89be859068a741379b25cf9f02ae9ba9cc26ceea16d30

Scan Results

Container: tccr.io/truecharts/alpine:v3.16.0@sha256:16dc15f3d61a1e30b1df9f839e53636847b6097286b2b74c637b25fd8264f730 (alpine 3.16.0)

alpine

No Vulnerabilities found

Container: tccr.io/truecharts/overseerr:v1.29.1@sha256:8b2e31f80dcdaed42ef89be859068a741379b25cf9f02ae9ba9cc26ceea16d30 (alpine 3.15.4)

alpine

No Vulnerabilities found

node-pkg

Package	Vulnerability	Severity	Installed Version	Fixed Version	Links
ansi-regex	CVE-2021-3807	HIGH	3.0.0	3.0.1, 4.1.1, 5.0.1, 6.0.1	Expand... https://access.redhat.com/security/cve/CVE-2021-3807 https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908 https://github.com/advisories/GHSA-93q8-gq69-wqmw https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9 https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311 https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774 https://github.com/chalk/ansi-regex/releases/tag/v6.0.1 https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994 https://linux.oracle.com/cve/CVE-2021-3807.html https://linux.oracle.com/errata/ELSA-2022-0350.html https://nvd.nist.gov/vuln/detail/CVE-2021-3807 https://www.oracle.com/security-alerts/cpuapr2022.html
ansi-regex	CVE-2021-3807	HIGH	5.0.0	3.0.1, 4.1.1, 5.0.1, 6.0.1	Expand... https://access.redhat.com/security/cve/CVE-2021-3807 https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908 https://github.com/advisories/GHSA-93q8-gq69-wqmw https://github.com/chalk/ansi-regex/commit/8d1d7cdb586269882c4bdc1b7325d0c58c8f76f9 https://github.com/chalk/ansi-regex/issues/38#issuecomment-924086311 https://github.com/chalk/ansi-regex/issues/38#issuecomment-925924774 https://github.com/chalk/ansi-regex/releases/tag/v6.0.1 https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994 https://linux.oracle.com/cve/CVE-2021-3807.html https://linux.oracle.com/errata/ELSA-2022-0350.html https://nvd.nist.gov/vuln/detail/CVE-2021-3807 https://www.oracle.com/security-alerts/cpuapr2022.html
dicer	CVE-2022-24434	HIGH	0.2.5		Expand... https://github.com/advisories/GHSA-wm7h-9275-46v2 https://github.com/mscdex/busboy/issues/250 https://github.com/mscdex/dicer/pull/22 https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac https://nvd.nist.gov/vuln/detail/CVE-2022-24434 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865 https://snyk.io/vuln/SNYK-JS-DICER-2311764
minimist	CVE-2021-44906	CRITICAL	1.2.5	1.2.6	Expand... https://access.redhat.com/security/cve/CVE-2021-44906 https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip https://github.com/advisories/GHSA-xvch-5gv4-984h https://github.com/substack/minimist/blob/master/index.js#L69 https://github.com/substack/minimist/issues/164 https://nvd.nist.gov/vuln/detail/CVE-2021-44906 https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764 https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 https://stackoverflow.com/questions/8588563/adding-custom-properties-to-a-function/20278068#20278068
moment	CVE-2022-24785	HIGH	2.29.1	2.29.2	Expand... https://access.redhat.com/security/cve/CVE-2022-24785 https://github.com/advisories/GHSA-8hfj-j24r-96c4 https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4 https://nvd.nist.gov/vuln/detail/CVE-2022-24785 https://security.netapp.com/advisory/ntap-20220513-0006/ https://www.tenable.com/security/tns-2022-09
npm	CVE-2022-29244	MEDIUM	8.5.0	8.11.0	Expand... https://access.redhat.com/security/cve/CVE-2022-29244 https://github.com/advisories/GHSA-hj9c-8jmm-8c52 https://github.com/nodejs/node/pull/43210 https://github.com/nodejs/node/releases/tag/v16.15.1 https://github.com/nodejs/node/releases/tag/v17.9.1 https://github.com/nodejs/node/releases/tag/v18.3.0 https://github.com/npm/cli/releases/tag/v8.11.0 https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52 https://github.com/npm/cli/tree/latest/workspaces/libnpmpack https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish https://github.com/npm/npm-packlist https://nvd.nist.gov/vuln/detail/CVE-2022-29244
sqlite3	CVE-2022-21227	HIGH	5.0.2	5.0.3	Expand... https://access.redhat.com/security/cve/CVE-2022-21227 https://github.com/TryGhost/node-sqlite3/commit/593c9d498be2510d286349134537e3bf89401c4a https://github.com/TryGhost/node-sqlite3/issues/1440 https://github.com/TryGhost/node-sqlite3/issues/1449 https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-9qrh-qjmc-5w2p https://github.com/advisories/GHSA-9qrh-qjmc-5w2p https://nvd.nist.gov/vuln/detail/CVE-2022-21227 https://security.snyk.io/vuln/SNYK-JS-SQLITE3-2388645 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2805470 https://snyk.io/vuln/SNYK-JS-SQLITE3-2388645