You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/10/13 11:44:01 UTC
[GitHub] [pulsar] hpvd opened a new issue, #18041: Arguments for "why pulsar is secure?"
hpvd opened a new issue, #18041:
URL: https://github.com/apache/pulsar/issues/18041
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Motivation
When people/companies evaluate open source software to rely and build on
they more and more
do not only look on its functional value
but also on topics like
- trust giving name/membership (e.g. part of Apache family)
- existing community size and growth
- development progress and
- especially security.
One thing often done, is a quick automated analysis
- of used dependencies
- their updated state
- number of contained unfixed CVEs (total)
- risk of these CVEs
- number of contained CVEs with available fix (unfixed)
This quick analysis gives a first taste/impression
on two things:
1) the potential of having a meaningful security problem when using the software
2) the awareness of the community for the topic security
Often you do not even have to do the analysis on your own,
but you can directly find analysis results using web search.
When doing this for pulsar,
you easily find e.g. on artifacthub.io
an analysis of the latest official helm chart for Apache Pulsar
https://github.com/apache/pulsar-helm-chart
the summarized result of security analysis shows:
> **992 vulnerabilities (623 fixable) have been detected in this package's
> images.**
In detail:
- there are dependencies with well known security issues (with official CVE numbers)
- there is a pretty huge number of known and documented vulnerabilities: 992
- including important ones (critical, high rating)
- not only in the accompanying software in helm (prometheus, grafana) but in core directly (pulsar)
- some were known for 9 years (CVE numbers from 2013)
- there are possible fixes for most of them (for 623)
see source https://artifacthub.io/packages/helm/apache/pulsar?modal=security-report
Of course, this is only a first rough impression given by this analysis.
And the chart does not contain the very latest version of pulsar (even so, it's the official helm chart)
When looking into every detail of the reported numbers, you can argue why not every counted vulnerabilities is a disaster.
=> But how can you easily argue to anyone having seen this fast result
> **In general, the software (pulsar) is secure, you can use it without any concerns.**
?
### Solution
_No response_
### Alternatives
_No response_
### Anything else?
_No response_
### Are you willing to submit a PR?
- [ ] I'm willing to submit a PR!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1277521943
some details:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eolivelli commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
eolivelli commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1277547564
@hpvd thanks for opening this issue. I think that your point is really valid.
I think that it is appropriate to start this discussion on the mailing lists (dev@pulsar.apache.org), as that's the place we run broad discussions.
Regarding this issue:
this issue is more about the "Apache Pulsar Helm Chart", that is on https://github.com/apache/pulsar-helm-chart
**maybe** it is better to post your findings there.
Regarding the core Pulsar package we try to keep all the dependencies as up-to-date as possible and to cut releases as soon as problems are discovered and reported to the PMC.
Unfortunately the Pulsar Helm Chart is not very active and this is way the default versions, even for the Pulsar docker image are pretty out-dated and we should upgrade
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1303156996
- on the other hand
- the number of vulnerabilities with a severity of CRITICAL has risen from 1 to 4 (+300%)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] github-actions[bot] commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1336625916
The issue had no activity for 30 days, mark with Stale label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1281973616
there is also an easy to use **github action for scanning with trivy**
- the complete repository,
- pull requests,
- docker container
- IaC
- etc.
=> Maybe this is interesting to integrate this directly into the CI pipeline...
See Readme of https://github.com/aquasecurity/trivy-action
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1278678843
just as background info, the security scanner used by artifacthub, providing results shown above
is trivy, **so all the finding should be pretty valid**.
For details, see:
https://artifacthub.io/docs/topics/security_report/
and trivy
https://github.com/aquasecurity/trivy
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1287436727
number of vulnerabilities is still growing:
Today Pulsars helm chart crosses the 1k:
**1005 vulnerabilities (683 fixable) have been detected in this package's images**.
see https://artifacthub.io/packages/helm/apache/pulsar?modal=security-report
Good to know there was hard work done during last week and there will be soon a major update
with updated pulsar (2.10.2) and a new monitoring stack
https://github.com/apache/pulsar-helm-chart/issues/326
Details and voting: https://lists.apache.org/thread/b02r3605jvmom23p1ccjbzsfwrq5tkjv
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1277838391
would be very interesting to see, how an updated helm chart with
- latest pulsar image (2.9.3 -> 2.10.1 or even 2.11)
https://github.com/apache/pulsar
- latest prometheus image (2.17.2 -> 2.39.1)
https://github.com/prometheus/prometheus
- latest streamnative/pulsar grafana image (0.0.16 -> no new release but in repository are some commits with updates)
https://github.com/streamnative/apache-pulsar-grafana-dashboard
would/will perform in the same scan.
=> is the update already the big part of the solution?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1277532433
before writing this issue, I had a conversation with Apache Security team,
that it is no problem to contribute this as normal issue:
> we'd warmly welcome .... if you'd contribute this finding as a normal bug
> report and/or patch to the project. Since outdated dependencies
> without further analysis are quite public, there is no need to use this
> private reporting mechanism in that case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun closed issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
tisonkun closed issue #18041: Arguments for "why pulsar is secure?"
URL: https://github.com/apache/pulsar/issues/18041
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1277516434
this is how the summary looks like:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1303141948
Latest security analysis show
- a stunning step in reducing the number included vulnerabilities:
- v2.9.4 with pulsar 2.9.3 ** 1024 vulnerabilities (698 fixable) have been detected in this package's images.**
https://artifacthub.io/packages/helm/apache/pulsar/2.9.4?modal=security-report
- v3.0.0 with pulsar 2.10.2 **136 vulnerabilities (79 fixable) have been detected in this package's images.**
https://artifacthub.io/packages/helm/apache/pulsar?modal=security-report
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1303135885
new Helm chart v 3.0 on the base of Pulsar 2.10.2 was just released:
https://github.com/apache/pulsar-helm-chart/releases/tag/pulsar-3.0.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #18041: Arguments for "why pulsar is secure?"
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #18041:
URL: https://github.com/apache/pulsar/issues/18041#issuecomment-1303160859
- very old fixable vulnerabilities (up to 9 years old) are still included:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org