Skip to content
This repository has been archived by the owner on Mar 12, 2024. It is now read-only.

Fix security issues for MIW Release R3.1.0 #44

Merged
merged 4 commits into from
May 12, 2023

Conversation

mknoopvw
Copy link
Contributor

Following security issues are supposed to be fixed by this -- due to re-run of github actions on the fixing branch then:

  • issues regarding outdated 'libssl' -- this should occur once the respective packaging github actions run on branch "main" again
  • issues regarding docker images run as root

@carslen carslen self-requested a review May 12, 2023 10:06
@carslen carslen self-assigned this May 12, 2023
@carslen
Copy link
Contributor

carslen commented May 12, 2023

Dockerfiles look good, but where to find the libssl fix? Did not get it.

@mknoopvw
Copy link
Contributor Author

There were two security issues on branch main regarding too much use of with X509-related requests. Unfortunately, I cannot obtain a recent issue number, maybe due to renaming the repository?
Nonetheless, the security issue numbers I refer to are: #624 and #625
These seemed to emerge from outdated linux images and these images are supposed to be re-created once a certain github action, namely "Build images and push to Github Package", is triggered on a branch as well as main.

I am not 100% sure how to describe these securiy issues without providing proper links to those issues. All apologies for not having those links available.

@mknoopvw
Copy link
Contributor Author

Addendum:

I found the respective findings in the ng-repository:
https://github.com/catenax-ng/tx-managed-identity-wallets/security/code-scanning/624
https://github.com/catenax-ng/tx-managed-identity-wallets/security/code-scanning/625

These findings point to an outdated libssl3 in generated images.
And those images will be re-generated once the respective github action is triggered; at best automatically due to pushed code.

@carslen
Copy link
Contributor

carslen commented May 12, 2023

Eclipse Contributor Agreement (ECA) check failed. Please ensure, that you are using the email address from your Eclipse Account in Github (or the other way around).

@carslen carslen merged commit 4beb555 into eclipse-tractusx:main May 12, 2023
@carslen carslen deleted the fix-security-issues branch May 12, 2023 12:09
@carslen
Copy link
Contributor

carslen commented May 12, 2023

ECA check for Committer Maximilian Schmidt failed. I accepted this for now as his commit 2e085bd got reverted with 4d84449. Maximilian will sign ECA for upcoming PRs.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants