Cloned2Preserve
/
TrueChartsClone
mirror of https://github.com/truecharts/charts.git
1
0
Fork 0
Code
TrueChartsClone/charts/stable/traefik/security.md

23 KiB
Raw Blame History

hide
toc

Security Overview

Helm-Chart

Scan Results

Chart Object: traefik/templates/common.yaml

Type Misconfiguration ID Check Severity Explaination Links
Kubernetes Security Check KSV001 Process can elevate its own privileges MEDIUM
Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.allowPrivilegeEscalation' to false
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv001
Kubernetes Security Check KSV001 Process can elevate its own privileges MEDIUM
Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.allowPrivilegeEscalation' to false
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv001
Kubernetes Security Check KSV003 Default capabilities not dropped LOW
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/misconfig/ksv003
Kubernetes Security Check KSV003 Default capabilities not dropped LOW
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/misconfig/ksv003
Kubernetes Security Check KSV012 Runs as root user MEDIUM
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv012
Kubernetes Security Check KSV014 Root file system is not read-only LOW
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/misconfig/ksv014
Kubernetes Security Check KSV017 Privileged container HIGH
Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.privileged' to false
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/misconfig/ksv017
Kubernetes Security Check KSV020 Runs with low user ID LOW
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/misconfig/ksv020
Kubernetes Security Check KSV020 Runs with low user ID LOW
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/misconfig/ksv020
Kubernetes Security Check KSV021 Runs with low group ID LOW
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/misconfig/ksv021
Kubernetes Security Check KSV021 Runs with low group ID LOW
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/misconfig/ksv021
Kubernetes Security Check KSV030 Default Seccomp profile not set LOW
Expand... The RuntimeDefault/Localhost seccomp profile must be required, or allow specific additional profiles.

Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv030
Kubernetes Security Check KSV030 Default Seccomp profile not set LOW
Expand... The RuntimeDefault/Localhost seccomp profile must be required, or allow specific additional profiles.

Either Pod or Container should set 'securityContext.seccompProfile.type' to 'RuntimeDefault'
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv030
Kubernetes Security Check KSV105 Containers must not set runAsUser to 0 LOW
Expand... Containers should be forbidden from running with a root UID.

securityContext.runAsUser should be set to a value greater than 0
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv105
Kubernetes Security Check KSV106 Container capabilities must only include NET_BIND_SERVICE LOW
Expand... Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

container should drop all
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv106
Kubernetes Security Check KSV106 Container capabilities must only include NET_BIND_SERVICE LOW
Expand... Containers must drop ALL capabilities, and are only permitted to add back the NET_BIND_SERVICE capability.

container should drop all
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/misconfig/ksv106
No Misconfigurations found
No Misconfigurations found
No Misconfigurations found
No Misconfigurations found

Containers

Detected Containers
      tccr.io/truecharts/alpine:v3.16.0@sha256:16dc15f3d61a1e30b1df9f839e53636847b6097286b2b74c637b25fd8264f730
      tccr.io/truecharts/traefik:v2.8.0@sha256:e00dd0a2db5e50f90b6c75e76021a9af968e0b9bb966760234da36a0b1836cae
Scan Results

Container: tccr.io/truecharts/alpine:v3.16.0@sha256:16dc15f3d61a1e30b1df9f839e53636847b6097286b2b74c637b25fd8264f730 (alpine 3.16.0)

alpine

Package Vulnerability Severity Installed Version Fixed Version Links
curl CVE-2022-32205 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32205
https://curl.se/docs/CVE-2022-32205.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32205
https://ubuntu.com/security/notices/USN-5495-1
curl CVE-2022-32206 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32206
https://curl.se/docs/CVE-2022-32206.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206
https://ubuntu.com/security/notices/USN-5495-1
curl CVE-2022-32207 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32207
https://curl.se/docs/CVE-2022-32207.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207
https://ubuntu.com/security/notices/USN-5495-1
curl CVE-2022-32208 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32208
https://curl.se/docs/CVE-2022-32208.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208
https://ubuntu.com/security/notices/USN-5495-1
libcurl CVE-2022-32205 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32205
https://curl.se/docs/CVE-2022-32205.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32205
https://ubuntu.com/security/notices/USN-5495-1
libcurl CVE-2022-32206 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32206
https://curl.se/docs/CVE-2022-32206.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32206
https://ubuntu.com/security/notices/USN-5495-1
libcurl CVE-2022-32207 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32207
https://curl.se/docs/CVE-2022-32207.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32207
https://ubuntu.com/security/notices/USN-5495-1
libcurl CVE-2022-32208 MEDIUM 7.83.1-r1 7.83.1-r2
Expand...https://access.redhat.com/security/cve/CVE-2022-32208
https://curl.se/docs/CVE-2022-32208.html
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32208
https://ubuntu.com/security/notices/USN-5495-1

Container: tccr.io/truecharts/traefik:v2.8.0@sha256:e00dd0a2db5e50f90b6c75e76021a9af968e0b9bb966760234da36a0b1836cae (alpine 3.15.4)

alpine

No Vulnerabilities found

gobinary

Package Vulnerability Severity Installed Version Fixed Version Links
github.com/containerd/containerd CVE-2022-23648 HIGH v1.5.9 1.4.13, 1.5.10, 1.6.1
Expand...http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html
https://access.redhat.com/security/cve/CVE-2022-23648
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23648
https://github.com/advisories/GHSA-crp2-qrr5-8pq7
https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70
https://github.com/containerd/containerd/releases/tag/v1.4.13
https://github.com/containerd/containerd/releases/tag/v1.5.10
https://github.com/containerd/containerd/releases/tag/v1.6.1
https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7
https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7.
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUDQUQBZJGBWJPMRVB6QCCCRF7O3O4PA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFTS2EF3S7HNYSNZSEJZIJHPRU7OPUV3/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCCARJ6FU4MWBTXHZNMS7NELPDBIX2VO/
https://nvd.nist.gov/vuln/detail/CVE-2022-23648
https://ubuntu.com/security/notices/USN-5311-1
https://ubuntu.com/security/notices/USN-5311-2
https://www.debian.org/security/2022/dsa-5091
github.com/docker/distribution GHSA-qq97-vm5h-rrhg UNKNOWN v2.7.1+incompatible v2.8.0
Expand...https://github.com/advisories/GHSA-qq97-vm5h-rrhg
https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586
https://github.com/distribution/distribution/security/advisories/GHSA-qq97-vm5h-rrhg
https://github.com/opencontainers/image-spec/pull/411
github.com/hashicorp/consul CVE-2022-29153 HIGH v1.10.4 1.9.17, 1.10.10, 1.11.5
Expand...https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
https://nvd.nist.gov/vuln/detail/CVE-2022-29153
https://security.netapp.com/advisory/ntap-20220602-0005/
github.com/hashicorp/consul CVE-2022-24687 MEDIUM v1.10.4 1.9.15, 1.10.8, 1.11.3
Expand...https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-05-consul-ingress-gateway-panic-can-shutdown-servers/
https://nvd.nist.gov/vuln/detail/CVE-2022-24687
https://security.netapp.com/advisory/ntap-20220331-0006/