Alpine Linux forums - Common Vulnerabilities and Exposures

I'm using Alpine RabbitMQ docker image and our security team has found unencrypted private keys in erlang-inets example package. Because of this our product has failed in security vulnerability test. I know this certificate is just a example one, however as the appcheck tool finds it, will be difficult to pass the test.

Can we somehow custom build erlang-inets removing the examples or is there a way to remove the example folder from the package. Could someone please help.

Regards,
Nihar

Bug #7357: Is there an ETA for 3.5.3?

spencerwilson-optimizely — Tue, 05 Sep 2017 23:14:53 +0000

Forums:

Common Vulnerabilities and Exposures

Hi all,

First off, thank you for the work you all put into maintaining Alpine. It is appreciated.

I was wondering when the 3.5.x branch might see its next release? A few CVEs had their fix merged 3 months ago (http://bugs.alpinelinux.org/issues/7357), but haven't yet seen release. I understand there is in general no firm release cadence; just am wondering if there is an estimate available on when might be released.

Our use case: our Docker application is based on mhart/alpine-node:7, which is based on alpine:3.5 (If you're curious, the official node:alpine-7 is on alpine:3.4, so is even older). Neither of which are likely maintained, as Node.js 7.x is not maintained. Images based on mhart/alpine-node:7 that are scanned with a security tool like Twistlock report a few of the vulnerabilities that were addressed in the above-linked bug.

Thanks in advance!

Cheers,
Spencer

chrome firefox package vulnerable from phishing attack

mmix — Wed, 26 Apr 2017 14:31:18 +0000

Forums:

Common Vulnerabilities and Exposures

chrome and firefox package from alpine linux are not safe from phishing attack.

latest chrome version safe but the version from alpine linux is 57.0.2987.133 (64-bit) which is NOT safe.

https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing/

Quote:

Chrome has just released version 58.0.3029.81. We have confirmed that this resolves the issue and that our ‘epic.com’ test domain no longer shows as ‘epic.com’ and displays the raw punycode instead, which is ‘www.xn--e1awd7f.com’, making it clear that the domain is not ‘epic.com’. We encourage all Chrome users to immediately update to the above version of Chrome to resolve the issue.

At this moment(2017.04.26), don't click the link at the site that you don't trust in alpine linux environment

--
PS:
How to fix this in Firefox:
In your firefox location bar, type ‘about:config’ without quotes.
Do a search for ‘punycode’ without quotes.
You should see a parameter titled: network.IDN_show_punycode
Change the value from false to true.

openssl CVE-2016-2180

sword — Mon, 29 Aug 2016 00:36:06 +0000

Forums:

Common Vulnerabilities and Exposures

Do alpine have any plan to fix this vulnerable?

Below link is a patch to fix this vulnerable:
https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a

Is there something like the '-security' lists of other distros?

Pearson — Mon, 06 Jul 2015 19:21:52 +0000

Forums:

Common Vulnerabilities and Exposures

I just read about Alpine Linux in this week's Distrowatch Weekly. This looks very interesting, and I'd like to look into it during my (limited) spare time. One question I have is whether the Apline package maintainers track and report which CVEs are fixed in which releases. In particular, if a security patch is applied to a release, then I presume the package version number would be bumped; in that case, would there be something that says "fixed CVE-xxxx-yyy"? Is there something that would collect those?

I saw the cvewatcher package described on this forum, and it looks promising. But, there is the caveat that it only looks at the package version and will have false positives if the CVE has been patched.

Ghost (CVE-2015-0235)

bwhite — Wed, 28 Jan 2015 18:49:38 +0000

Forums:

Common Vulnerabilities and Exposures

Is Alpine Linux 3.1 (or other version) vulnerable to GHOST? https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability

xorg-server: a 20 year old security bug

AmatCoder — Fri, 18 Oct 2013 18:15:04 +0000

Forums:

Common Vulnerabilities and Exposures

I inaugurate this section...;-)

http://lists.freedesktop.org/archives/xorg/2013-October/056074.html

Regards.