26 lines
2.3 KiB
Markdown
26 lines
2.3 KiB
Markdown
# Security policy
|
||
|
||
Security fixes target the latest release. Older releases have no guaranteed
|
||
backport support. Upgrade before verifying whether an issue is still present.
|
||
|
||
Do not publish credentials, private photos, production logs, or working exploit
|
||
payloads in public issues. Contact the repository owner privately through the
|
||
hosting platform when available. If no private contact channel is available,
|
||
open an issue asking for a confidential reporting channel without technical
|
||
vulnerability details. There is currently no dedicated security mailbox or
|
||
promised response SLA.
|
||
|
||
A useful private report includes the affected version, deployment mode, required
|
||
permissions, impact, and minimal steps using mock data. Do not test on another
|
||
person's deployment or write to real frames without explicit authorization.
|
||
|
||
## 当前容器基础系统扫描
|
||
|
||
2026-10-18 使用 Trivy 0.76.0 扫描当前映像。在构建阶段应用 Debian 安全更新后，可修复的 HIGH/CRITICAL 项已清除；仍有 63 条发行版包级告警，合并为 16 个 CVE，当前 Bookworm 无可用修复版本。不能将 Python 依赖检查通过描述为整个映像零漏洞。
|
||
|
||
- [CVE-2023-45853](https://security-tracker.debian.org/tracker/CVE-2023-45853) 针对 MiniZip；Debian 明确 Bookworm 的 zlib 未构建相应代码，本映像也未安装 MiniZip。
|
||
- [CVE-2025-7458](https://security-tracker.debian.org/tracker/CVE-2025-7458) 需要攻击者执行特制 SQL；Frame Flow 不接受任意 SQL 或上传外部 SQLite 数据库。FTS5 相关 [CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)、[CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824) 的匹配查询也未被应用使用。此结论不适用于自行替换数据库或修改服务 SQL 的部署。
|
||
- 其他告警涉及挂载/命名空间工具、systemd-homed、ACL、ncurses、Perl/LZH CLI 及 DTLS；应用未调用这些路径。默认 UID/GID 10333、只读根目录、清空 capabilities、禁提权和独立数据卷仍是必要边界。
|
||
|
||
本轮未发现这些遗留项在默认应用路径中的可达利用入口，不将该判断扩展为基础系统已修复。后续基础映像更新仍须复扫；不得为消除扫描数字而混装其他 Debian 发行版包或删除许可声明。
|