eilandert / dockerized Goto Github PK
View Code? Open in Web Editor NEWdockerized stuff
Home Page: https://hub.docker.com/u/eilandert
dockerized stuff
Home Page: https://hub.docker.com/u/eilandert
It seems that njs module is missing. At least in latest release.
我通过如下命令创建了容器,但是80端口访问不了,请问下是什么原因
docker run
-itd
--network=host
--restart=always
--name=nginx
eilandert/nginx-modsecurity3-pagespeed
Python HTTP for Humans.
Library home page: https://files.pythonhosted.org/packages/70/8e/0e2d847013cb52cd35b38c009bb167a1a26b2ce6cd6965bf26b47bc0bf44/requests-2.31.0-py3-none-any.whl
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
Requests is a HTTP library. Prior to 2.32.2, when making requests through a Requests Session
, if the first request is made with verify=False
to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify
. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.2.
Publish Date: 2024-05-20
URL: CVE-2024-35195
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9wx4-h78v-vm56
Release Date: 2024-05-20
Fix Resolution: requests - 2.32.2
Step up your Open Source Security Game with Mend here
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Publish Date: 2023-11-29
URL: CVE-2023-49082
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-qvrw-v9rv-5rjx
Release Date: 2023-11-29
Fix Resolution: 3.9.0
Step up your Open Source Security Game with Mend here
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Mend Note: The vulnerability was fixed in version 3.9.4 (unaffected). A few minor follow-up patches were added in 3.9.5, as stated in GHSA-5m98-qgg9-wh84.
Publish Date: 2024-05-02
URL: CVE-2024-30251
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5m98-qgg9-wh84
Release Date: 2024-05-02
Fix Resolution: 3.9.4
Step up your Open Source Security Game with Mend here
Python package for providing Mozilla's CA Bundle.
Library home page: https://files.pythonhosted.org/packages/ba/06/a07f096c664aeb9f01624f858c3add0a4e913d6c96257acb4fce61e7de14/certifi-2024.2.2-py3-none-any.whl
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt,/sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from GLOBALTRUST
. Certifi 2024.07.04 removes root certificates from GLOBALTRUST
from the root store. These are in the process of being removed from Mozilla's trust store. GLOBALTRUST
's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."
Publish Date: 2024-07-05
URL: CVE-2024-39689
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-248v-346w-9cwc
Release Date: 2024-07-05
Fix Resolution: certifi - 2024.07.04
Step up your Open Source Security Game with Mend here
Backport of pathlib-compatible object wrapper for zip files
Library home page: https://files.pythonhosted.org/packages/5b/fa/c9e82bbe1af6266adf08afb563905eb87cab83fde00a0a08963510621047/zipp-3.15.0-py3-none-any.whl
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path
module in both zipp and zipfile, such as joinpath
, the overloaded division operator, and iterdir
. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.
Publish Date: 2024-07-09
URL: CVE-2024-5569
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae
Release Date: 2024-07-09
Fix Resolution (zipp): 3.19.1
Direct dependency fix Resolution (pytest): 8.0.0
Step up your Open Source Security Game with Mend here
Hey there all the images are currently hosted inside docker hub but I noticed there is no ARM version of any of the images. Can you please also build the images for ARM
I was just looking at a random Dockerfile of yours and noticed you use ;
to separate commands rather than &&
. That'd cause a non-zero exit code to be ignored and the image build to succeed.
Groeten uit Nijmegen :)
gpg is missing which causes issues with the repo validation
$ podman run --rm -ti eilandert/ubuntu-base:rolling bash
root@f43185bab6ef:/# apt-get update
Get:1 http://deb.paranoid.nl hirsute InRelease [3646 B]
Get:2 http://ppa.launchpad.net/ondrej/php/ubuntu groovy InRelease [23.9 kB]
Get:3 http://archive.ubuntu.com/ubuntu hirsute InRelease [269 kB]
Err:1 http://deb.paranoid.nl hirsute InRelease
gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
Get:4 http://archive.ubuntu.com/ubuntu hirsute-updates InRelease [109 kB]
Get:5 http://archive.ubuntu.com/ubuntu hirsute-backports InRelease [90.7 kB]
Ign:2 http://ppa.launchpad.net/ondrej/php/ubuntu groovy InRelease
Get:6 http://security.ubuntu.com/ubuntu hirsute-security InRelease [101 kB]
Get:7 http://ppa.launchpad.net/ondrej/php/ubuntu groovy/main amd64 Packages [147 kB]
Err:3 http://archive.ubuntu.com/ubuntu hirsute InRelease
gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
Err:4 http://archive.ubuntu.com/ubuntu hirsute-updates InRelease
gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
Err:5 http://archive.ubuntu.com/ubuntu hirsute-backports InRelease
gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
Err:6 http://security.ubuntu.com/ubuntu hirsute-security InRelease
gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
Reading package lists... Done
W: GPG error: http://deb.paranoid.nl hirsute InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://deb.paranoid.nl hirsute InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://ppa.launchpad.net/ondrej/php/ubuntu groovy InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute-updates InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute-updates InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://archive.ubuntu.com/ubuntu hirsute-backports InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://archive.ubuntu.com/ubuntu hirsute-backports InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: GPG error: http://security.ubuntu.com/ubuntu hirsute-security InRelease: gpgv, gpgv2 or gpgv1 required for verification, but neither seems installed
E: The repository 'http://security.ubuntu.com/ubuntu hirsute-security InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'follow_symlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'follow_symlinks' is set to True, there is no validation to check if reading a file is within the root directory. This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. Disabling follow_symlinks and using a reverse proxy are encouraged mitigations. Version 3.9.2 fixes this issue.
Publish Date: 2024-01-29
URL: CVE-2024-23334
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5h86-8mv2-jq9f
Release Date: 2024-01-29
Fix Resolution: 3.9.2
Step up your Open Source Security Game with Mend here
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Publish Date: 2023-11-30
URL: CVE-2023-49081
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-q3qx-c6g2-7pw2
Release Date: 2023-11-30
Fix Resolution: 3.9.0
Step up your Open Source Security Game with Mend here
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/d2/b2/b157855192a68541a91ba7b2bbcb91f1b4faa51f8bae38d8005c034be524/urllib3-2.0.7-py3-none-any.whl
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager
, the Proxy-Authorization
header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidentally configure the Proxy-Authorization
header even though it won't have any effect as the request is not using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the Proxy-Authorization
HTTP header as one carrying authentication material and thus doesn't strip the header on cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip the Proxy-Authorization
header during cross-origin redirects to avoid the small chance that users are doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve safe processing of the Proxy-Authorization
header, but we still decided to strip the header by default in order to further protect users who aren't using the correct approach. We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting the Proxy-Authorization
header without using urllib3's built-in proxy support. 2. Not disabling HTTP redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to upgrade may use the Proxy-Authorization
header with urllib3's ProxyManager
, disable HTTP redirects using redirects=False
when sending requests, or not user the Proxy-Authorization
header as mitigations.
Publish Date: 2024-06-17
URL: CVE-2024-37891
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-34jh-p97f-mpxf
Release Date: 2024-06-17
Fix Resolution: urllib3 - 1.26.19,2.2.2
Step up your Open Source Security Game with Mend here
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input. Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.
Publish Date: 2024-01-29
URL: CVE-2024-23829
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-8qpw-xqxj-h4r2
Release Date: 2024-01-29
Fix Resolution: 3.9.2
Step up your Open Source Security Game with Mend here
Async http client/server framework (asyncio)
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for serving static files. Users following the recommendation are unaffected. Other users can disable show_index
if unable to upgrade.
Publish Date: 2024-04-18
URL: CVE-2024-27306
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-7gpw-8wmc-pm8g
Release Date: 2024-04-18
Fix Resolution: 3.9.4
Step up your Open Source Security Game with Mend here
Fundamental package for array computing in Python
Path to dependency file: /sitemap_warmup/requirements.txt
Path to vulnerable library: /sitemap_warmup/requirements.txt
Dependency Hierarchy:
Found in base branch: master
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141
Publish Date: 2021-12-17
URL: CVE-2021-34141
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141
Release Date: 2021-12-17
Fix Resolution: 1.22.0
Step up your Open Source Security Game with Mend here
on line 67 on start.sh it shows hmod 600 /repo/ssh/*key insead of chmod 600 /repo/ssh/*key causing the image to fail to start.
I am trying to use the image reprepro and when I use the ssh keys it keeps saying Permission denied (publickey). I have double, triple and quadruple checked the key and even generated new ones to see if it will work. Got any ideas how to make this work? I love the image outside that one little bug.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.