diff --git a/.grype.yaml b/.grype.yaml index 1131684..23614b6 100644 --- a/.grype.yaml +++ b/.grype.yaml @@ -1,2 +1,24 @@ ignore: - vulnerability: CVE-2025-27558 # Not able to fix it at the moment + # False positive: Grype's binary classifier reads the PHP interpreter's own version + # string (embedded in /usr/local/bin/php, libphp.so, and the bundled extensions such + # as curl.so) as a "curl" binary, then flags these curl CVEs (all fixed in curl + # 8.21.0). The REAL curl is the Debian package, patched (8.14.1-2+deb13u4) and + # correctly not flagged. Scoped per-CVE to binary-classified curl so a genuine future + # curl finding still surfaces instead of being blanket-ignored. + - vulnerability: CVE-2026-11856 + package: + name: curl + type: binary + - vulnerability: CVE-2026-10536 + package: + name: curl + type: binary + - vulnerability: CVE-2026-8927 + package: + name: curl + type: binary + - vulnerability: CVE-2026-8924 + package: + name: curl + type: binary diff --git a/CLAUDE.md b/CLAUDE.md index d28be23..8b74d26 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -91,6 +91,7 @@ The entrypoint script handles: |---|---| | `DB_SETUP` | `automatic`, `automatic-only`, `manual`, `delete` | | `DB_SETUP_PASS` | Password used when setting up the DB | +| `DB_SSL_ENABLED` | Opt-in, **default off**. Set to exactly `true` to add `--ssl-mode=REQUIRED --enable-cleartext-plugin` to the privileged setup/delete MySQL client (for databases that require the cleartext auth plugin to be sent over TLS). Any other value / unset ⇒ unchanged plaintext-capable connection. | | `SIMPLERISK_DB_HOSTNAME` | External DB host | | `SIMPLERISK_DB_USERNAME/PASSWORD/DATABASE` | DB credentials | | `SIMPLERISK_CRON_SETUP` | Enable/disable PHP cron (default: enabled) | diff --git a/simplerisk-minimal/Dockerfile b/simplerisk-minimal/Dockerfile index b62dd3c..fb395b3 100644 --- a/simplerisk-minimal/Dockerfile +++ b/simplerisk-minimal/Dockerfile @@ -24,7 +24,11 @@ ARG TARGETARCH # NOTE: The MySQL key was taken from https://dev.mysql.com/doc/refman/8.4/en/checking-gpg-signature.html # amd64: mysql-community-client from MySQL's Debian repo # arm64: default-mysql-client from Debian (MySQL's apt repo has no arm64 packages) +# apt-get upgrade patches base-image packages (apache2, curl, ...) with Debian +# security updates -- the pinned php:${php_version}-apache base ships them at its +# own build-time versions, so without this they accumulate fixed CVEs (Grype gate). RUN apt-get update && \ + apt-get -y upgrade && \ apt-get install -y --no-install-recommends \ libldap2-dev \ libicu-dev \ diff --git a/simplerisk-minimal/README.md b/simplerisk-minimal/README.md index a8961c1..8484358 100644 --- a/simplerisk-minimal/README.md +++ b/simplerisk-minimal/README.md @@ -64,6 +64,7 @@ docker run -d --name simplerisk -e SIMPLERISK_DB_PASSWORD=pass -e SIMPLERISK_DB_ | `DB_SETUP_USER` | `root` | Used when `DB_SETUP=automatic\|automatic-only\|delete`. User name of database privileged user to install SimpleRisk schema and other components | | `DB_SETUP_PASS` | `root` (the bundled `stack.yml` ships `simplerisk_setup`) | Used when `DB_SETUP=automatic\|automatic-only\|delete`. Password of the privileged MySQL user used **only** to install the SimpleRisk schema and create the app DB user. In `stack.yml` it is also the bundled MySQL root password; since that MySQL is not exposed outside the stack network, a documented default is used for the zero-config trial. Override it (and `MYSQL_ROOT_PASSWORD` in `stack.yml`) for any non-trial deployment. | | `DB_SETUP_WAIT` | 20 | Used when `DB_SETUP=automatic\|automatic-only`. Time, in seconds, the application is going to wait to set up the database. Useful if you are deploying the database and SimpleRisk at the same time | +| `DB_SSL_ENABLED` | `false` (off) | Opt-in, used when `DB_SETUP=automatic\|automatic-only\|delete`. Set to exactly `true` to require TLS on the privileged setup/delete MySQL client connection (adds `--ssl-mode=REQUIRED --enable-cleartext-plugin`). Any other value, or unset, leaves the connection unchanged (plaintext-capable) | | `SIMPLERISK_DB_HOSTNAME` | `localhost` | Hostname of the database server | | `SIMPLERISK_DB_PORT` | 3306 | Port to contact the database | | `SIMPLERISK_DB_USERNAME` |`simplerisk` | User name to be used to access the SimpleRisk database | diff --git a/simplerisk-minimal/common/entrypoint.sh b/simplerisk-minimal/common/entrypoint.sh index 8e47e35..014c178 100644 --- a/simplerisk-minimal/common/entrypoint.sh +++ b/simplerisk-minimal/common/entrypoint.sh @@ -252,13 +252,24 @@ set_mail_settings(){ [ -n "${MAIL_PASSWORD:-}" ] && apply_mail_setting phpmailer_password "$MAIL_PASSWORD" || true } +set_db_ssl_flags(){ + # Some databases require the privileged setup/delete mysql client to send + # its credential via the cleartext auth plugin, which the server only + # accepts over TLS (e.g. when DB_SETUP_PASS is a short-lived auth token + # rather than a static password). Set DB_SSL_ENABLED=true to opt in. + DB_SSL_FLAGS="" + if [ "${DB_SSL_ENABLED:-}" = "true" ]; then + DB_SSL_FLAGS="--ssl-mode=REQUIRED --enable-cleartext-plugin" + fi +} + delete_db(){ print_log "db_deletion: prepare" "Performing database deletion" # Pass password via env var to avoid shell interpretation of special characters in the value export MYSQL_PWD="$DB_SETUP_PASS" # Needed to separate the GRANT statement from the rest because it was providing a syntax error - exec_cmd "mysql -u $DB_SETUP_USER -h$SIMPLERISK_DB_HOSTNAME -P$SIMPLERISK_DB_PORT <