diff --git a/.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md b/.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md new file mode 100644 index 000000000..04cf99bb0 --- /dev/null +++ b/.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md @@ -0,0 +1,107 @@ +--- +name: run-manual-docker-security-scan +description: Guide for running a manual Docker security scan for the tracker runtime image and documenting results. Covers build, Trivy scan, CVE triage, per-CVE catalog updates, and scan history updates. Use when asked to run a manual container scan, triage Docker CVEs, or refresh security scan docs. +metadata: + author: torrust + version: "1.0" + semantic-links: + related-artifacts: + - Containerfile + - docs/security/README.md + - docs/security/docker/README.md + - docs/security/docker/scans/README.md + - docs/security/docker/scans/torrust-tracker.md + - docs/security/analysis/README.md + - docs/security/analysis/non-affecting/ +--- + +# Run Manual Docker Security Scan + +Use this workflow to run and document manual security scans for the tracker production container. + +## Scope + +- Target image: tracker runtime image built from root `Containerfile`. +- Main severity gate: `HIGH,CRITICAL`. +- Documentation outputs: + - `docs/security/docker/scans/torrust-tracker.md` + - `docs/security/docker/scans/README.md` + - `docs/security/analysis/non-affecting/CVE-*.md` (when non-affecting CVEs are analyzed) + +## Quick Commands + +```bash +# 1) Build runtime image +docker build -t torrust-tracker:local -f Containerfile . + +# 2) Gate scan (primary) +trivy image --severity HIGH,CRITICAL torrust-tracker:local + +# 3) Full context scan (optional but recommended) +trivy image --severity MEDIUM,HIGH,CRITICAL torrust-tracker:local +``` + +## Workflow + +### Step 1: Check Existing Catalog First + +Before analyzing any CVE, search the existing catalog: + +```bash +grep -R "CVE-" docs/security/analysis/non-affecting/ +``` + +If already present and `requires-recheck-when` conditions have not changed, reuse the existing verdict. + +### Step 2: Build and Scan + +- Build local runtime image from `Containerfile`. +- Run the gate scan with `HIGH,CRITICAL`. +- Run optional full scan (`MEDIUM,HIGH,CRITICAL`) to capture trend context. + +### Step 3: Update Scan History Docs + +Update: + +- `docs/security/docker/scans/torrust-tracker.md` with: + - date/time, Trivy version, totals by severity + - notable CVEs and rationale +- `docs/security/docker/scans/README.md` summary table with latest status and date. + +### Step 4: Document New Non-Affecting CVEs + +For any new non-affecting CVE, create `docs/security/analysis/non-affecting/CVE-.md` with: + +- frontmatter fields: + - `cve-id` + - `date-analyzed` + - `source` + - `status: non-affecting` + - `review-cadence` + - `requires-recheck-when` +- evidence-based explanation tied to tracker architecture +- conditions that would invalidate the current verdict + +### Step 5: Escalate Affecting CVEs + +If a CVE is affecting: + +- create/update a tracking issue +- include impact, affected component, exploitability context, and remediation plan +- update scan docs with current status and owner + +## Recheck Triggers + +Re-evaluate catalog verdicts when any of these happen: + +- `Containerfile` base image changes +- new runtime/system dependency is introduced +- code path changes that satisfy a CVE file's `requires-recheck-when` condition + +## Completion Checklist + +- [ ] `trivy` gate scan executed (`HIGH,CRITICAL`) +- [ ] scan history files updated +- [ ] new CVEs cataloged or linked to existing catalog entries +- [ ] affecting CVEs escalated +- [ ] `linter all` passes diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml new file mode 100644 index 000000000..6a8326d27 --- /dev/null +++ b/.github/workflows/security-scan.yaml @@ -0,0 +1,91 @@ +name: Security Scan + +on: + push: + branches: [main, develop] + paths: + - "Containerfile" + - ".github/workflows/security-scan.yaml" + + pull_request: + paths: + - "Containerfile" + - ".github/workflows/security-scan.yaml" + + # Scheduled scans are important because new CVEs appear + # even if the code or images didn't change + schedule: + - cron: "0 6 * * *" # Daily at 6 AM UTC + + workflow_dispatch: + +env: + CARGO_TERM_COLOR: always + +jobs: + security-scan: + name: Security Scan + runs-on: ubuntu-latest + # Scheduled scans pull the pre-built image; push/PR triggers rebuild from + # source (Containerfile change). Rust compilation can exceed 25 min. + timeout-minutes: 45 + permissions: + contents: read + security-events: write + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + # Scheduled scans use the pre-built develop image from Docker Hub. + # Push/PR triggers on Containerfile changes need to build from source. + - name: Determine image source + id: image-source + run: | + if [ "${{ github.event_name }}" = "schedule" ]; then + echo "method=pull" >> "$GITHUB_OUTPUT" + echo "image=torrust/tracker:develop" >> "$GITHUB_OUTPUT" + else + echo "method=build" >> "$GITHUB_OUTPUT" + echo "image=torrust-tracker:local" >> "$GITHUB_OUTPUT" + fi + + - name: Pull or build Docker image + run: | + if [ "${{ steps.image-source.outputs.method }}" = "pull" ]; then + docker pull "${{ steps.image-source.outputs.image }}" + else + docker build -t "${{ steps.image-source.outputs.image }}" -f Containerfile . + fi + + # Human-readable output in logs + # This NEVER fails the job; it's only for visibility + - name: Display vulnerabilities (table format) + uses: aquasecurity/trivy-action@0.35.0 + with: + image-ref: ${{ steps.image-source.outputs.image }} + format: "table" + severity: "HIGH,CRITICAL" + exit-code: "0" + + # SARIF generation for GitHub Code Scanning + # + # IMPORTANT: + # - exit-code MUST be 0 + # - Trivy sometimes exits with 1 even when no vulns exist + # - GitHub Security UI is responsible for enforcement + - name: Generate SARIF (Code Scanning) + uses: aquasecurity/trivy-action@0.35.0 + with: + image-ref: ${{ steps.image-source.outputs.image }} + format: "sarif" + output: "trivy-results.sarif" + severity: "HIGH,CRITICAL" + exit-code: "0" + scanners: "vuln" + + - name: Upload SARIF to Code Scanning + uses: github/codeql-action/upload-sarif@v4 + if: always() + with: + sarif_file: trivy-results.sarif diff --git a/README.md b/README.md index f99732de2..174637eb8 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Torrust Tracker -[![container_wf_b]][container_wf] [![coverage_wf_b]][coverage_wf] [![deployment_wf_b]][deployment_wf] [![testing_wf_b]][testing_wf] [![os_compat_wf_b]][os_compat_wf] [![db_compat_wf_b]][db_compat_wf] [![db_bench_wf_b]][db_bench_wf] [![docs_lint_wf_b]][docs_lint_wf] +[![container_wf_b]][container_wf] [![coverage_wf_b]][coverage_wf] [![deployment_wf_b]][deployment_wf] [![testing_wf_b]][testing_wf] [![os_compat_wf_b]][os_compat_wf] [![db_compat_wf_b]][db_compat_wf] [![db_bench_wf_b]][db_bench_wf] [![docs_lint_wf_b]][docs_lint_wf] [![security_scan_wf_b]][security_scan_wf] **Torrust Tracker** is a [BitTorrent][bittorrent] Tracker that matchmakes peers and collects statistics. Written in [Rust Language][rust] with the [Axum] web framework. **This tracker aims to be respectful to established standards, (both [formal][BEP 00] and [otherwise][torrent_source_felid]).** @@ -270,6 +270,8 @@ This project was a joint effort by [Nautilus Cyberneering GmbH][nautilus] and [D [db_bench_wf_b]: ../../actions/workflows/db-benchmarking.yaml/badge.svg [docs_lint_wf]: ../../actions/workflows/docs-lint.yaml [docs_lint_wf_b]: ../../actions/workflows/docs-lint.yaml/badge.svg +[security_scan_wf]: ../../actions/workflows/security-scan.yaml +[security_scan_wf_b]: ../../actions/workflows/security-scan.yaml/badge.svg [bittorrent]: http://bittorrent.org/ [rust]: https://www.rust-lang.org/ [axum]: https://github.com/tokio-rs/axum diff --git a/docs/issues/open/1459-docker-security-overhaul/ISSUE.md b/docs/issues/open/1459-docker-security-overhaul/ISSUE.md new file mode 100644 index 000000000..67316b70b --- /dev/null +++ b/docs/issues/open/1459-docker-security-overhaul/ISSUE.md @@ -0,0 +1,158 @@ +--- +doc-type: issue +issue-type: task +status: completed +priority: p2 +github-issue: 1459 +spec-path: docs/issues/open/1459-docker-security-overhaul/ISSUE.md +branch: 1459-docker-security-overhaul +related-pr: "https://github.com/torrust/torrust-tracker/pull/1958" +last-updated-utc: 2026-06-29 +semantic-links: + skill-links: + - create-issue + related-artifacts: + - .github/workflows/security-scan.yaml + - Containerfile + - .github/workflows/container.yaml + - .github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md + - docs/security/README.md + - docs/security/docker/scans/ + - docs/security/docker/README.md + - docs/security/analysis/non-affecting/ +--- + +# Issue #1459 - Docker Security Overhaul: Set Up Security Scanning Workflow + +## Problem + +The torrust-tracker Docker image contains known vulnerabilities that need to be regularly scanned and monitored. As demonstrated by the Trivy scan results, the current image has multiple security vulnerabilities including critical, high, and medium severity issues. + +## Goal + +Implement a scheduled workflow to periodically scan Docker images for vulnerabilities and misconfigurations, ensuring the security posture of the application is maintained. + +## Acceptance Criteria + +- [x] A new GitHub Actions workflow is created in `.github/workflows/security-scan.yaml` +- [x] The workflow runs on a schedule (daily) to scan the Docker image +- [x] The workflow builds the Docker image and scans it with Trivy +- [x] Vulnerability findings are reported in both human-readable and SARIF formats +- [x] The workflow integrates with the existing container build process +- [x] The README.md badge row includes the new security scan workflow badge +- [x] `docs/security/docker/scans/` is created with the first baseline scan report +- [x] `docs/security/docker/README.md` provides scanning instructions +- [x] `docs/security/README.md` provides a priority-tier security overview +- [x] Per-CVE analysis files created in `docs/security/analysis/non-affecting/` for each + MEDIUM vulnerability found in the baseline scan +- [x] `docs/security/analysis/README.md` documents the catalog strategy and recheck policy +- [x] A maintenance skill exists at + `.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md` + documenting how to run and document manual Docker security scans + +## Implementation Plan + +### Step 1: Create Security Scan Workflow + +Create a new workflow file `.github/workflows/security-scan.yaml` that: + +- Runs on a schedule (daily at 6 AM UTC) and on push to main/develop branches +- Builds the Docker image using the Containerfile +- Scans the image with Trivy +- Reports results in both table and SARIF formats + +### Step 2: Configure Trivy Scanning + +Configure the workflow to: + +- Use Trivy to scan the Docker image +- Report vulnerabilities in both human-readable table format and SARIF format for GitHub Code Scanning +- Generate SARIF output for integration with GitHub Security features + +### Step 3: Integrate with Existing Workflows + +Ensure the security scan workflow integrates properly with the existing container workflow. + +### Step 4: Add Workflow Badge to README.md + +Add the security scan workflow badge to the README.md header row and consistent reference links at the bottom, following the same pattern as existing workflow badges. + +### Step 5: Create Security Documentation and Run Baseline Scan + +Create `docs/security/docker/` structure mirroring the deployer's security docs pattern: + +- `docs/security/docker/README.md` — scanning instructions and context +- `docs/security/docker/scans/README.md` — scan history index table +- `docs/security/docker/scans/torrust-tracker.md` — detailed scan report with vulnerability analysis + +Run the first manual baseline scan of the production `release` stage image and document all findings, including vulnerability analysis and severity assessment. + +### Step 6: Create Top-Level Security Overview + +Create `docs/security/README.md` providing a priority-tier overview of security areas for the project, mirroring the deployer's top-level security README pattern: + +- Priority 1: Production Docker image (critical, internet-exposed) +- Priority 2: Vulnerability analysis (evaluation and tracking) +- Priority 3: Build chain security (lower-risk, build-time only) +- Current security status summary +- Scan tooling reference + +### Step 7: Create Non-Affecting CVE Catalog + +Create per-CVE analysis files in `docs/security/analysis/non-affecting/` for each +vulnerability found in the baseline scan, following this pattern: + +```text +non-affecting/ +├── CVE-2026-5435.md # glibc TSIG +├── CVE-2026-5450.md # glibc scanf +├── CVE-2026-5928.md # glibc ungetwc +├── CVE-2026-6238.md # glibc DNS response +└── CVE-2026-27171.md # zlib CRC32 +``` + +Each file includes: + +- Frontmatter with `cve-id`, `date-analyzed`, `source`, `status`, `review-cadence`, + and `requires-recheck-when` conditions +- Vulnerability description and severity +- Evidence-based rationale for why it does not affect the tracker +- Conditions that would change the verdict + +Update `docs/security/analysis/README.md` to document the catalog strategy (one catalog +for all vulnerability sources, per-CVE files preferred, with recheck policy). + +### Step 8: Add Maintenance Skill for Manual Security Scans + +Create a new skill at +`.github/skills/dev/maintenance/run-manual-docker-security-scan/SKILL.md` to standardize +how contributors run manual Docker security scans and maintain scan documentation. + +The skill should include: + +- build and scan commands (`docker build`, `trivy image`) +- triage workflow (check catalog first, then analyze) +- documentation update requirements (`docs/security/docker/scans/*` and + `docs/security/analysis/non-affecting/CVE-*.md`) +- recheck triggers and escalation path for affecting vulnerabilities + +## References + +- Original issue: https://github.com/torrust/torrust-tracker/issues/1459 +- Related issue #1630 +- Trivy documentation for GitHub Actions integration +- Tracker Deployer security scan workflow for reference: https://github.com/torrust/torrust-tracker-deployer/blob/main/.github/workflows/docker-security-scan.yml + +## Verification Plan + +### Automatic Checks + +- [ ] Workflow file is created and syntactically correct +- [ ] Workflow runs successfully on schedule +- [ ] Trivy scan produces expected output + +### Manual Verification Scenarios + +- [ ] Run workflow manually to verify it scans the image +- [ ] Verify vulnerability reports are generated correctly +- [ ] Confirm workflow integrates with existing container workflow diff --git a/docs/security/README.md b/docs/security/README.md new file mode 100644 index 000000000..9e96cbd12 --- /dev/null +++ b/docs/security/README.md @@ -0,0 +1,86 @@ +# Security Overview + +This directory documents security considerations for the Torrust Tracker project, organized by priority level. + +## Priority Levels + +Security effort should be distributed according to exposure and risk. The highest-priority areas are those that directly affect end users in production. + +### Priority 1 — Production Docker Image (Critical) + +**Directory**: [`docker/`](docker/) + +The production Docker image (`release` stage based on `gcr.io/distroless/cc-debian13`) is the most critical security surface. It is exposed to the internet and runs continuously. Any vulnerability here directly affects tracker users. + +**Scope**: + +- The tracker binary +- OS base layer (distroless/cc-debian13) +- Transitive library dependencies (glibc, zlib) + +**Scan history**: [`docker/scans/`](docker/scans/) + +--- + +### Priority 2 — Vulnerability Analysis (Important) + +**Directory**: [`analysis/`](analysis/) + +When a security issue is detected (Docker Scout, dependabot, manual audit, container image scans), we create an analysis document to evaluate whether it actually affects the tracker. + +**Scope**: + +- Evaluating CVEs reported by scanning tools +- Documenting non-affecting vulnerabilities +- Tracking affecting vulnerabilities with remediation plans + +**Documents**: + +- [Analysis README](analysis/README.md) — process and document index +- [Non-affecting CVEs](analysis/non-affecting/) — analyzed and accepted vulnerabilities + +--- + +### Priority 3 — Build Chain Security (Standard) + +The build-time images (`chef`, `tester`, `gcc` stages in the `Containerfile`) are a **lower-risk surface** because: + +- They run only during CI/CD or local builds +- They are not exposed to the internet +- They produce the final artifact but are not deployed themselves + +This priority increases if the build images are ever used in a long-running service. + +**Scope**: + +- Base build images: `rust:trixie`, `rust:slim-trixie`, `gcc:trixie` +- Rust dependency vulnerabilities (`cargo audit` / RustSec) +- CI/CD pipeline security + +--- + +## Scan Tooling + +| Tool | Purpose | Run Command | +| ----- | ------------------------- | ---------------------------------------------- | +| Trivy | Docker image CVE scanning | `trivy image --severity HIGH,CRITICAL ` | + +## Current Security Status + +### Production Image + +See [`docker/scans/README.md`](docker/scans/README.md) for the latest status of the production `release` stage image. + +### Vulnerability Analysis + +See [`analysis/README.md`](analysis/README.md) for cataloged vulnerability evaluations. + +**Non-affecting CVE catalog**: [`analysis/non-affecting/`](analysis/non-affecting/) — +per-CVE files documenting why each vulnerability does not affect the tracker and what +conditions would change the verdict. + +## Related Documentation + +- [Docker Image Security](docker/README.md) — scanning instructions and scan history +- [Security Analysis](analysis/README.md) — CVE evaluation process +- [`SECURITY.md`](../../SECURITY.md) — project security policy and reporting diff --git a/docs/security/analysis/README.md b/docs/security/analysis/README.md index 5bfb6f0d0..1603635de 100644 --- a/docs/security/analysis/README.md +++ b/docs/security/analysis/README.md @@ -6,6 +6,7 @@ semantic-links: - Containerfile - docs/security/analysis/non-affecting/ - docs/adrs/20260603000000_keep_unit_tests_inside_container_build.md + - docs/security/docker/scans/torrust-tracker.md --- # Security Analysis @@ -29,39 +30,68 @@ container image vulnerability scanning), we create an analysis document here to: docs/security/analysis/ ├── README.md # This file — index and process ├── non-affecting/ # Vulnerabilities that do NOT affect us -│ └── {date}_{descriptive-name}.md -└── ... # (future) Affecting vulnerabilities go here +│ ├── CVE-{id}.md # Per-CVE files (preferred for individual CVEs) +│ └── {date}_{source}.md # Bulk scan/event files (for bulk triage) +└── affecting/ # (future) Vulnerabilities that DO affect us +``` + +## Catalog Strategy + +We use **one catalog** for all vulnerability sources (Docker scans, cargo-audit, dependabot, +etc.). A vulnerability is a vulnerability regardless of origin. + +### Per-CVE Files (preferred) + +Individual CVEs from container scans are documented in their own file: + +```text +non-affecting/ +├── CVE-2026-5435.md # glibc TSIG +├── CVE-2026-5450.md # glibc scanf +├── CVE-2026-5928.md # glibc ungetwc +├── CVE-2026-6238.md # glibc DNS response +└── CVE-2026-27171.md # zlib CRC32 +``` + +**Advantages**: + +- `grep -r CVE-2026-5435` finds it instantly. +- Fast to check "have we seen this before?" on any new scan. +- Each file carries its own `review-date`, `review-cadence`, and `requires-recheck-when` + in frontmatter. + +### Bulk Scan/Event Files + +For bulk triage (e.g. a full Docker Scout report with dozens of CVEs), a single event-based +file can be used instead of creating individual CVE files. Example: + +```text +non-affecting/ +└── 2026-06-10_containerfile-trixie-cves.md # Bulk triage of 100+ CVEs ``` ## Process ### When a security warning appears -1. **Check the catalog**: search `docs/security/analysis/non-affecting/` to see if this - vulnerability has already been analyzed. If it has, you're done — the document explains - why it doesn't affect us and what to watch for. +1. **Check the catalog**: `grep -r '' docs/security/analysis/non-affecting/` to + see if this vulnerability has already been analyzed. If it has, verify the + `requires-recheck-when` conditions still hold. If they do, you're done. -2. **If not yet cataloged**: create a new analysis document in `non-affecting/` (or an - appropriate subfolder) following the template below. +2. **If not yet cataloged**: create a new per-CVE analysis document in `non-affecting/` + following the template below. 3. **If it DOES affect us**: escalate immediately. Create an issue and a fix. The analysis document should describe the impact, affected components, and remediation plan. -### Analysis Document Template - -Each analysis document should include: - -- **Date of analysis** -- **Source of the warning** (tool, scanner, CVE database, etc.) -- **Vulnerability summary** — what CVEs, what packages, what severity -- **Why it does not affect us** — a clear rationale tied to our architecture -- **Future actions** — periodic review cadence, conditions that would change the status -- **References** — links to the original warning, Docker Hub layers, CVE entries, etc. +### Recheck Policy -### Review Cadence +Non-affecting verdicts can become stale when dependencies or code change. Each per-CVE file +has a `requires-recheck-when` field that specifies the conditions under which the verdict +must be re-evaluated. -Non-affecting vulnerabilities should be reviewed: +**Triggers for recheck**: -- At least **quarterly** (or when the relevant base image is updated). -- Immediately if the affected image begins being used in a **different context** (e.g., if - a build-stage image becomes part of the runtime). +- A change to the `Containerfile` base image. +- A new system dependency added (e.g., via new `FROM` stage or package install). +- Any change that affects the `requires-recheck-when` condition documented in the CVE file. diff --git a/docs/security/analysis/non-affecting/2026-06-10_containerfile-trixie-cves.md b/docs/security/analysis/non-affecting/2026-06-10_containerfile-trixie-cves.md index 79edd3f9a..e010ca6df 100644 --- a/docs/security/analysis/non-affecting/2026-06-10_containerfile-trixie-cves.md +++ b/docs/security/analysis/non-affecting/2026-06-10_containerfile-trixie-cves.md @@ -3,6 +3,7 @@ date-analyzed: 2026-06-10 source: Docker DX (docker-language-server) / Docker Scout status: non-affecting review-cadence: quarterly +requires-recheck-when: any build-stage image (`chef`, `tester`, `gcc`) is used in a runtime context image-digest: sha256:19dfb952582d0e17841fdb8cd70febfb6cb0761c4e0cd84f3cb1f07bb3281a8d semantic-links: related-artifacts: diff --git a/docs/security/analysis/non-affecting/CVE-2026-27171.md b/docs/security/analysis/non-affecting/CVE-2026-27171.md new file mode 100644 index 000000000..5a0397cdb --- /dev/null +++ b/docs/security/analysis/non-affecting/CVE-2026-27171.md @@ -0,0 +1,39 @@ +--- +cve-id: CVE-2026-27171 +date-analyzed: 2026-06-29 +source: Trivy (Docker image scan) +status: non-affecting +review-cadence: quarterly +requires-recheck-when: tracker statically links or dynamically loads the system zlib library +related-artifacts: + - Containerfile + - docs/security/docker/scans/torrust-tracker.md +--- + +# CVE-2026-27171 — zlib: Denial of Service via infinite loop in CRC32 combine functions + +## Vulnerability + +Denial of Service via infinite loop in zlib's CRC32 combine function. An attacker can +cause an infinite loop by calling `crc32_combine()` or `crc32_combine64()` with crafted +inputs. + +- **Severity**: MEDIUM +- **Package**: zlib1g 1:1.3.dfsg+really1.3.1-1+b1 +- **Link**: https://avd.aquasec.com/nvd/cve-2026-27171 + +## Why It Does NOT Affect Us + +The tracker uses `tower-http` with `compression-full` for optional HTTP response +compression middleware (gzip, brotli, zstd). However, this uses `flate2` → `miniz_oxide` +(pure Rust implementation of zlib), **not** the system `zlib1g` library. The system +`zlib1g` is only pulled in as a transitive dependency of distroless base OS packages, not +used by the tracker binary itself. Additionally, CRC32 combine is a specialized function +not exercised by normal compression/decompression. + +## Conditions That Would Change This Verdict + +- If the tracker starts to statically link or dynamically load the system `zlib1g` for + compression +- If the Rust `flate2` crate switches from its default pure-Rust backend (`miniz_oxide`) + to the system zlib backend diff --git a/docs/security/analysis/non-affecting/CVE-2026-5435.md b/docs/security/analysis/non-affecting/CVE-2026-5435.md new file mode 100644 index 000000000..49ce27e39 --- /dev/null +++ b/docs/security/analysis/non-affecting/CVE-2026-5435.md @@ -0,0 +1,37 @@ +--- +cve-id: CVE-2026-5435 +date-analyzed: 2026-06-29 +source: Trivy (Docker image scan) +status: non-affecting +review-cadence: quarterly +requires-recheck-when: production code adds DNS resolution that calls glibc resolver functions +related-artifacts: + - Containerfile + - docs/security/docker/scans/torrust-tracker.md +--- + +# CVE-2026-5435 — glibc: Out-of-bounds write via TSIG record processing + +## Vulnerability + +Out-of-bounds write in glibc's DNS TSIG (Transaction Signature) record processing. An +attacker can trigger this by sending a crafted DNS response with a malicious TSIG record, +potentially leading to memory corruption. + +- **Severity**: MEDIUM +- **Package**: libc6 (glibc) 2.41-12+deb13u3 +- **Link**: https://avd.aquasec.com/nvd/cve-2026-5435 + +## Why It Does NOT Affect Us + +The tracker server performs **no DNS resolution** in its production code paths. Peer IP +resolution is done from HTTP headers (`X-Forwarded-For`) or socket addresses, not DNS. +The only DNS resolution occurs inside `sqlx` lazily when connecting to MySQL/PostgreSQL +databases, which does not use glibc's TSIG record processing path. + +## Conditions That Would Change This Verdict + +- If the tracker server adds code that performs DNS resolution using glibc resolver + functions (`gethostbyname`, `res_nquery`, `getaddrinfo`, etc.) +- If `sqlx` DNS resolution ever triggers the TSIG code path (unlikely — TSIG is + specific to DNSSEC-secured zone transfers, not normal A/AAAA lookups) diff --git a/docs/security/analysis/non-affecting/CVE-2026-5450.md b/docs/security/analysis/non-affecting/CVE-2026-5450.md new file mode 100644 index 000000000..2f4bf64de --- /dev/null +++ b/docs/security/analysis/non-affecting/CVE-2026-5450.md @@ -0,0 +1,34 @@ +--- +cve-id: CVE-2026-5450 +date-analyzed: 2026-06-29 +source: Trivy (Docker image scan) +status: non-affecting +review-cadence: quarterly +requires-recheck-when: production code adds C stdio input parsing via scanf-family functions +related-artifacts: + - Containerfile + - docs/security/docker/scans/torrust-tracker.md +--- + +# CVE-2026-5450 — glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier + +## Vulnerability + +Heap buffer overflow in the `scanf` family with the `%mc` format specifier. An attacker +can trigger memory corruption by providing crafted input to a program that uses `scanf`, +`sscanf`, `fscanf`, etc. + +- **Severity**: MEDIUM +- **Package**: libc6 (glibc) 2.41-12+deb13u3 +- **Link**: https://avd.aquasec.com/nvd/cve-2026-5450 + +## Why It Does NOT Affect Us + +The tracker codebase contains **zero uses** of `scanf`, `sscanf`, or any C stdio input +functions. All input parsing is done in safe Rust. A search of the entire codebase confirms +no occurrences of any scanf-family functions. + +## Conditions That Would Change This Verdict + +- If new code adds C FFI calls that use `scanf`-family functions on untrusted input +- If a new dependency links a native library that uses `scanf` on attacker-controlled data diff --git a/docs/security/analysis/non-affecting/CVE-2026-5928.md b/docs/security/analysis/non-affecting/CVE-2026-5928.md new file mode 100644 index 000000000..1c07b2b30 --- /dev/null +++ b/docs/security/analysis/non-affecting/CVE-2026-5928.md @@ -0,0 +1,34 @@ +--- +cve-id: CVE-2026-5928 +date-analyzed: 2026-06-29 +source: Trivy (Docker image scan) +status: non-affecting +review-cadence: quarterly +requires-recheck-when: production code adds wide character I/O via ungetwc-family functions +related-artifacts: + - Containerfile + - docs/security/docker/scans/torrust-tracker.md +--- + +# CVE-2026-5928 — glibc: Information disclosure or denial of service via `ungetwc` function + +## Vulnerability + +Information disclosure or denial of service via the `ungetwc` (wide character un-get) +function in glibc. An attacker can potentially read freed memory or cause a crash by +manipulating the wide character input buffer. + +- **Severity**: MEDIUM +- **Package**: libc6 (glibc) 2.41-12+deb13u3 +- **Link**: https://avd.aquasec.com/nvd/cve-2026-5928 + +## Why It Does NOT Affect Us + +The tracker does not use wide character I/O functions (`ungetwc`, `fgetwc`, `fputwc`, +etc.). The codebase contains no usage of these functions. + +## Conditions That Would Change This Verdict + +- If new code adds wide character stream I/O via glibc C FFI +- If a new dependency links a native library that exercises `ungetwc` on attacker-controlled + data diff --git a/docs/security/analysis/non-affecting/CVE-2026-6238.md b/docs/security/analysis/non-affecting/CVE-2026-6238.md new file mode 100644 index 000000000..a10b1c3dc --- /dev/null +++ b/docs/security/analysis/non-affecting/CVE-2026-6238.md @@ -0,0 +1,38 @@ +--- +cve-id: CVE-2026-6238 +date-analyzed: 2026-06-29 +source: Trivy (Docker image scan) +status: non-affecting +review-cadence: quarterly +requires-recheck-when: production code adds DNS resolution via glibc resolver functions +related-artifacts: + - Containerfile + - docs/security/docker/scans/torrust-tracker.md +--- + +# CVE-2026-6238 — glibc: Application crash or uninitialized memory read via crafted DNS response + +## Vulnerability + +Application crash or uninitialized memory read via crafted DNS response. This affects +glibc's internal DNS resolution functions (`gethostbyname`, `res_nquery`, etc.). An +attacker controlling a DNS server can respond with a malicious packet that causes memory +corruption. + +- **Severity**: MEDIUM +- **Package**: libc6 (glibc) 2.41-12+deb13u3 +- **Link**: https://avd.aquasec.com/nvd/cve-2026-6238 + +## Why It Does NOT Affect Us + +The tracker server performs **no DNS resolution** directly. Peer IP resolution is done +from HTTP headers (`X-Forwarded-For`) or socket addresses, not hostname lookup. Database +hostname resolution is done lazily inside `sqlx` at first query time using Tokio's async +DNS or system `getaddrinfo`, which does not call the affected glibc resolver path. + +## Conditions That Would Change This Verdict + +- If the tracker server adds code that performs DNS resolution using glibc resolver + functions directly (`gethostbyname`, `res_nquery`, etc.) +- If `sqlx` is upgraded to a version that uses a different resolver triggering this path + (unlikely — `sqlx` delegates to Tokio/OS resolution, not glibc resolver internals) diff --git a/docs/security/docker/README.md b/docs/security/docker/README.md new file mode 100644 index 000000000..384881088 --- /dev/null +++ b/docs/security/docker/README.md @@ -0,0 +1,62 @@ +# Docker Image Security + +This directory covers security scanning for the Torrust Tracker Docker image. + +## Purpose + +Regular security scanning ensures that the tracker's container image is free from known +vulnerabilities. This documentation provides: + +- Instructions for running security scans on the tracker image +- Scan history and current status +- Vulnerability management decisions + +## Automated Scanning + +See the [Security Scan workflow](../../../.github/workflows/security-scan.yaml) for automated +scheduled scanning via GitHub Actions. + +## Manual Scanning with Trivy + +### Installation + +```bash +# macOS +brew install trivy + +# Linux (Debian/Ubuntu) +sudo apt-get install trivy + +# Or use Docker +docker run --rm aquasec/trivy:latest image +``` + +### Scan Commands + +**Build the image**: + +```bash +docker build -t torrust-tracker:local -f Containerfile . +``` + +**Scan for HIGH and CRITICAL only** (standard production check): + +```bash +trivy image --severity HIGH,CRITICAL torrust-tracker:local +``` + +**Scan with all severities** (full report): + +```bash +trivy image --severity MEDIUM,HIGH,CRITICAL torrust-tracker:local +``` + +### Severity Levels + +- `CRITICAL`: Exploitable vulnerabilities with severe impact +- `HIGH`: Significant vulnerabilities requiring attention +- `MEDIUM`: Moderate vulnerabilities (tracked for awareness) + +## Scan Results + +See [`scans/`](scans/) for the full scan history. diff --git a/docs/security/docker/scans/README.md b/docs/security/docker/scans/README.md new file mode 100644 index 000000000..ae9614919 --- /dev/null +++ b/docs/security/docker/scans/README.md @@ -0,0 +1,21 @@ +# Docker Image Scan Results + +Historical security scan results for the Torrust Tracker Docker image. + +## Current Status Summary + +| Image | Stage | MEDIUM | HIGH | CRITICAL | Status | Last Scan | Details | +| ----------------- | ------- | ------ | ---- | -------- | -------- | ------------ | -------------------------- | +| `torrust-tracker` | release | 5 | 0 | 0 | ✅ Clean | Jun 29, 2026 | [View](torrust-tracker.md) | + +## Build and Scan + +```bash +# Build the production release image +docker build -t torrust-tracker:local -f Containerfile . + +# Scan +trivy image --severity HIGH,CRITICAL torrust-tracker:local +``` + +See [`../README.md`](../README.md) for detailed scanning instructions. diff --git a/docs/security/docker/scans/torrust-tracker.md b/docs/security/docker/scans/torrust-tracker.md new file mode 100644 index 000000000..7bd374ad7 --- /dev/null +++ b/docs/security/docker/scans/torrust-tracker.md @@ -0,0 +1,94 @@ +# Torrust Tracker - Security Scans + +Security scan history for the `torrust-tracker` Docker image. + +## Current Status + +| Stage | MEDIUM | HIGH | CRITICAL | Status | Last Scan | +| ------- | ------ | ---- | -------- | -------- | ------------ | +| release | 5 | 0 | 0 | ✅ Clean | Jun 29, 2026 | + +## Build & Scan Commands + +**Build the image**: + +```bash +docker build -t torrust-tracker:local -f Containerfile . +``` + +**Run Trivy security scan**: + +```bash +trivy image --severity HIGH,CRITICAL torrust-tracker:local +``` + +**Full scan with all severities**: + +```bash +trivy image --severity MEDIUM,HIGH,CRITICAL torrust-tracker:local +``` + +## Scan History + +### June 29, 2026 - Baseline + +**Image**: `torrust-tracker:local` +**Trivy Version**: 0.69.3 +**Scan Mode**: `--severity MEDIUM,HIGH,CRITICAL` +**Base OS**: Debian 13.5 (trixie, distroless/cc-debian13) +**Status**: ✅ **Clean** — 5 MEDIUM, 0 HIGH, 0 CRITICAL + +#### Summary + +This is the baseline scan for the Torrust Tracker production runtime image. The image uses +`gcr.io/distroless/cc-debian13` as the runtime base, which is a minimal distroless image. +All 5 findings are MEDIUM-severity CVEs in OS base libraries (`libc6` and `zlib1g`). + +#### Vulnerability Details (all MEDIUM) + +| CVE | Package | Installed Version | Title | +| -------------- | ------- | --------------------------- | ------------------------------------------------------------------------------ | +| CVE-2026-5435 | libc6 | 2.41-12+deb13u3 | glibc: Out-of-bounds write via TSIG record processing | +| CVE-2026-5450 | libc6 | 2.41-12+deb13u3 | glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier | +| CVE-2026-5928 | libc6 | 2.41-12+deb13u3 | glibc: Information disclosure or denial of service via `ungetwc` function | +| CVE-2026-6238 | libc6 | 2.41-12+deb13u3 | glibc: Application crash or uninitialized memory read via crafted DNS response | +| CVE-2026-27171 | zlib1g | 1:1.3.dfsg+really1.3.1-1+b1 | zlib: Denial of Service via infinite loop in CRC32 combine functions | + +#### Analysis + +- **CVE-2026-5435** (TSIG record processing): Affects DNS TSIG record handling in glibc. + The tracker server performs **no DNS resolution** in its production code paths. Peer IP + resolution is done from HTTP headers (`X-Forwarded-For`) or socket addresses, not DNS. + The only DNS resolution occurs inside `sqlx` lazily when connecting to MySQL/PostgreSQL + databases, which does not use glibc's TSIG record processing path. **Non-affecting**. + +- **CVE-2026-5450** (scanf `%mc`): Heap buffer overflow in the `scanf` family with the + `%mc` format specifier. The tracker codebase contains **zero uses** of `scanf`, `sscanf`, + or any C stdio input functions. Input parsing is done entirely in safe Rust. + **Non-affecting**. + +- **CVE-2026-5928** (ungetwc): Information disclosure or DoS via `ungetwc`. The tracker + does not use wide character I/O functions (`ungetwc`, `fgetwc`, etc.). **Non-affecting**. + +- **CVE-2026-6238** (DNS response): Crash or uninitialized memory read via crafted DNS + response. This affects glibc's internal DNS resolution (`gethostbyname`, `res_nquery`, + etc.). The tracker server performs **no DNS resolution** directly — peer IP resolution + is from HTTP headers/socket addresses, not hostname lookup. Database hostname resolution + is done lazily inside `sqlx` at first query time, which does not trigger the affected + code path. **Non-affecting**. + +- **CVE-2026-27171** (zlib CRC32): DoS via infinite loop in CRC32 combine function. + The tracker uses `tower-http` with `compression-full` for optional HTTP response + compression middleware (gzip, brotli, zstd). However, this uses `flate2` → `miniz_oxide` + (pure Rust implementation of zlib), **not** the system `zlib1g` library. The system `zlib1g` + is only pulled in as a transitive dependency of distroless base OS packages, not used by + the tracker binary itself. Additionally, CRC32 combine is a specialized function not + exercised by normal compression/decompression. **Non-affecting**. + +#### Next Steps + +- All 5 MEDIUM CVEs are **non-affecting** for the current runtime — accepted risk. +- Re-scan quarterly to track OS package updates from the distroless base image. +- If the base image is updated, re-scan and update this report. +- Consider filing issues for specific CVEs if they become fixable (e.g., via Debian security + updates to the distroless base). diff --git a/project-words.txt b/project-words.txt index ec32c47d7..9196fd97e 100644 --- a/project-words.txt +++ b/project-words.txt @@ -13,6 +13,8 @@ alloca analyse analysed appuser +aquasec +aquasecurity argjson artefacts Arvid @@ -48,7 +50,6 @@ Bragilevsky bufs buildid BuildKit -bottlenecked Buildx byteorder callgrind @@ -91,6 +92,7 @@ debuginfo defence depgraph Deque +dfsg DGRAM Dihc Dijke @@ -98,6 +100,7 @@ distroless distros dler Dmqcd +DNSSEC dockerhub doctest downloadedi @@ -114,25 +117,33 @@ eprint eprintln Eray eventfd +exploitability fastrand fdbased fdget +fgetwc filesd finalises flamegraph flamegraphs +flate +flate2 fnix footgun formalised formalises formatjson fput +fputwc fract Freebox frontmatter Frostegård +fscanf Garnham gecos +getaddrinfo +gethostbyname ghac Gibibytes Glrg @@ -190,6 +201,8 @@ lcov leafification leecher leechers +libc +libc6 libheif libhwloc libraw @@ -210,6 +223,8 @@ microbenchmark microbenchmarks middlewares millis +miniz +miniz_oxide misresolved mktemp mmap @@ -222,7 +237,6 @@ multimap myacicontext mysqladmin mysqld -ñaca Naim nanos newkey @@ -238,6 +252,7 @@ nonblocking nonroot Norberg notnull +nquery numwant nvCFlJCq7fz7Qx6KoKTDiMZvns8l5Kw7 objcopy @@ -323,7 +338,9 @@ rustfmt Rustls rustup Ryzen +sarif savepath +scanf sccache Seedable serde @@ -343,9 +360,9 @@ specialised sqllite sqlx srcset +sscanf stabilised subissue -Subissue Subissues subkey subsec @@ -379,9 +396,13 @@ torrustracker trackerid Trackon triaging -trixie +trivy +trivy-action +trivy-results +Trixie trunc tryhackx +TSIG tslconfig ttwu typenum @@ -391,8 +412,8 @@ Unamed unconfigured UNCONN underflows +ungetwc uninit -Uninit unittests unparked Unparker @@ -435,3 +456,4 @@ xxxxxxxxxxxxxxxxxxxxd yyyyyyyyyyyyyyyyyyyyd zerocopy zstd +ñaca