2.3 KiB
Security policy
Security fixes target the latest release. Older releases have no guaranteed backport support. Upgrade before verifying whether an issue is still present.
Do not publish credentials, private photos, production logs, or working exploit payloads in public issues. Contact the repository owner privately through the hosting platform when available. If no private contact channel is available, open an issue asking for a confidential reporting channel without technical vulnerability details. There is currently no dedicated security mailbox or promised response SLA.
A useful private report includes the affected version, deployment mode, required permissions, impact, and minimal steps using mock data. Do not test on another person's deployment or write to real frames without explicit authorization.
当前容器基础系统扫描
2026-10-18 使用 Trivy 0.76.0 扫描当前映像。在构建阶段应用 Debian 安全更新后，可修复的 HIGH/CRITICAL 项已清除；仍有 63 条发行版包级告警，合并为 16 个 CVE，当前 Bookworm 无可用修复版本。不能将 Python 依赖检查通过描述为整个映像零漏洞。
- CVE-2023-45853 针对 MiniZip；Debian 明确 Bookworm 的 zlib 未构建相应代码，本映像也未安装 MiniZip。
- CVE-2025-7458 需要攻击者执行特制 SQL；Frame Flow 不接受任意 SQL 或上传外部 SQLite 数据库。FTS5 相关 CVE-2026-11822、CVE-2026-11824 的匹配查询也未被应用使用。此结论不适用于自行替换数据库或修改服务 SQL 的部署。
- 其他告警涉及挂载/命名空间工具、systemd-homed、ACL、ncurses、Perl/LZH CLI 及 DTLS；应用未调用这些路径。默认 UID/GID 10333、只读根目录、清空 capabilities、禁提权和独立数据卷仍是必要边界。
本轮未发现这些遗留项在默认应用路径中的可达利用入口，不将该判断扩展为基础系统已修复。后续基础映像更新仍须复扫；不得为消除扫描数字而混装其他 Debian 发行版包或删除许可声明。