diff --git a/docs/releases/server-1.6.531.md b/docs/releases/server-1.6.531.md index 36d99bef66..b73625c687 100644 --- a/docs/releases/server-1.6.531.md +++ b/docs/releases/server-1.6.531.md @@ -1,7 +1,6 @@ # Server v1.6.531 -本版目前為來源組裝候選，尚未發布 Server 映像。 -組裝已正式不可變發行的 Engine `v0.183.348` 與 Web Console `1.6.186`。 +本版組裝已正式不可變發行的 Engine `v0.183.348` 與 Web Console `1.6.186`。 Engine 的預設專案範本名稱對齊真正 Catalog `project.yml` 的 `PastureStack Native`。乾淨安裝的共用 Default 能自動綁定範本； @@ -37,12 +36,43 @@ Web 的原共用 driver card 在模型沒有 `catalogDisplayName` 時顯示 nati 其他元件及 pins、工具鏈、readonly/restricted schema SHA、後端、角色、 HTTPS origin、MFA、nftables、Compose／HA 與資料庫結構均保留。 -安全清單僅更新 Server 數字識別；VEX 決策、vendor-pending exact-set、 -原必要 gates 與既有元件歷史負控制不弱化。 +安全清單更新 Server 數字識別及下列精確 vendor-pending 範圍；VEX 決策、 +vendor-pending exact-set、原必要 gates 與既有元件歷史負控制不弱化。 -Server 原來源／封裝、安全／SBOM、CodeQL、不可變發行及成品讀回仍須通過。 -乾淨安裝的零主機／首台主機 readiness、driver 初始化／重啟識別及部署待驗。 -README 安裝範例暫維持已存在發行 tag；531 實際發行及原生驗收後才更新。 +## 待 vendor 的安全範圍 + +正式發布 run `38507013620` 在 merged-rootfs 安全 exact-set gate 停止， +尚未發布 Server 映像。該次 Trivy 原始掃描新增 6 個 PCRE2 CVE， +各對應 Ubuntu 26.04 `libpcre2-8-0` 與 `libpcre2-posix3` 的 +`10.46-1build1`，合計 12 筆 MEDIUM，`FixedVersion` 均為空。 +vendor-pending 現記錄共 10 個 CVE／20 筆精確 MEDIUM package findings， +覆核期限維持 `2026-10-20`。 + +2026-10-14 03:45 UTC 直接讀回 Ubuntu 官方 HTTP 200 頁面： + +- Ubuntu 26.04 pcre2 標為 Vulnerable： + [CVE-2026-103111](https://ubuntu.com/security/CVE-2026-103111)、 + [CVE-2026-89156](https://ubuntu.com/security/CVE-2026-89156)、 + [CVE-2026-89157](https://ubuntu.com/security/CVE-2026-89157)、 + [CVE-2026-89158](https://ubuntu.com/security/CVE-2026-89158)、 + [CVE-2026-89160](https://ubuntu.com/security/CVE-2026-89160)， + 頁面最後更新為 2026-10-13。 +- Ubuntu 26.04 pcre2 標為 Needs evaluation： + [CVE-2026-89162](https://ubuntu.com/security/CVE-2026-89162)， + 頁面最後更新為 2026-09-16。 + +上述官方狀態未列出 Ubuntu 26.04 已發布修復版本。 +tracker 的 `needs-evaluation` 沿用本專案的到期覆核狀態， +不是 Canonical 的套件狀態；新增項目的 `upstreamVendorStatus` 與 +`verifiedAt` 保留此次官方讀回。這些 finding 仍待 vendor，未宣告已修復、 +未改成 VEX not-affected 或安全豁免。允許 severity、空 `FixedVersion`、 +精確 package/CVE/version/target 比對與原發布 gates 保持原契約； +正式 pipeline 仍須用最新掃描重新通過安全與發布驗證。 + +發行流程保留原來源／封裝、安全／SBOM、CodeQL、不可變發行及成品讀回閘門。 +部署驗收涵蓋零主機／首台主機 readiness、driver 初始化／重啟識別； +上述元件測試不等於完整角色／資源矩陣通過。安裝及元件配對見 Server README， +正式映像身分與安全掃描結果由同版本 GitHub Release 提供。 ## 升級與回復 diff --git a/server/security/vendor-pending.json b/server/security/vendor-pending.json index 619ef58e0d..141f84e8be 100644 --- a/server/security/vendor-pending.json +++ b/server/security/vendor-pending.json @@ -1,7 +1,7 @@ { "schemaVersion": 1, "release": "v1.6.531", - "generatedAt": "2026-10-10T00:00:00Z", + "generatedAt": "2026-10-14T00:00:00Z", "policy": { "allowedSeverities": [ "LOW", @@ -13,6 +13,19 @@ "trivyTarget": "/rootfs (ubuntu 26.04)" }, "findings": [ + { + "vulnerabilityId": "CVE-2026-103111", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Vulnerable", + "verifiedAt": "2026-10-14T03:45:54Z", + "source": "https://ubuntu.com/security/CVE-2026-103111", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, { "vulnerabilityId": "CVE-2026-85091", "severity": "MEDIUM", @@ -46,6 +59,58 @@ { "name": "libc6", "installedVersion": "2.43-2ubuntu2.4" } ] }, + { + "vulnerabilityId": "CVE-2026-89156", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Vulnerable", + "verifiedAt": "2026-10-14T03:45:55Z", + "source": "https://ubuntu.com/security/CVE-2026-89156", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89157", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Vulnerable", + "verifiedAt": "2026-10-14T03:45:55Z", + "source": "https://ubuntu.com/security/CVE-2026-89157", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89158", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Vulnerable", + "verifiedAt": "2026-10-14T03:45:29Z", + "source": "https://ubuntu.com/security/CVE-2026-89158", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, + { + "vulnerabilityId": "CVE-2026-89160", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Vulnerable", + "verifiedAt": "2026-10-14T03:45:28Z", + "source": "https://ubuntu.com/security/CVE-2026-89160", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] + }, { "vulnerabilityId": "CVE-2026-89161", "severity": "MEDIUM", @@ -56,6 +121,19 @@ { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } ] + }, + { + "vulnerabilityId": "CVE-2026-89162", + "severity": "MEDIUM", + "vendorStatus": "needs-evaluation", + "upstreamVendorStatus": "Needs evaluation", + "verifiedAt": "2026-10-14T03:45:28Z", + "source": "https://ubuntu.com/security/CVE-2026-89162", + "reviewAfter": "2026-10-20", + "packages": [ + { "name": "libpcre2-8-0", "installedVersion": "10.46-1build1" }, + { "name": "libpcre2-posix3", "installedVersion": "10.46-1build1" } + ] } ] }