jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(hardening): bump cadvisor, node-exporter and fail2ban off CRITICAL CVEs #139

Merged
jfraeys merged 1 commit from jfraeys/fix/bump-critical-cve-images into main 2026-10-13 19:40:11 -04:00
Conversation 0 Commits 1 Files changed 4 +7 -7
jfraeys commented 2026-10-13 19:31:29 -04:00
Owner
Copy link

First trivy report (2026-10-13, services) failed 8 of 15 images on CRITICAL findings. This clears three of them:

  • prom/node-exporter v1.10.2 -> v1.12.1 (was 1 CRITICAL, Go stdlib)
  • gcr.io/cadvisor/cadvisor v0.49.1 -> ghcr.io/google/cadvisor v0.60.6 (was 5; gcr.io has no newer tag, the project publishes to ghcr.io now)
  • crazymax/fail2ban 1.1.0 -> 1.1.1 (was 3, openssh-client)

Verified with trivy image --severity CRITICAL on services: 0 CRITICAL for each new tag. All eight trimmed cAdvisor flags in the compose template still exist in v0.60.6 (checked against --help). docs/tool-versions.yml pin regex updated for the new cAdvisor path.

Not covered here (separate PRs / accepted risk): hugo, watchtower, postfix, lldap, vaultwarden.

Review: the cAdvisor jump is large; staging should confirm container_last_seen{name=...} still feeds the PostfixDown alert.

🤖 Generated with Claude Code

First trivy report (2026-10-13, services) failed 8 of 15 images on CRITICAL findings. This clears three of them: - prom/node-exporter v1.10.2 -> v1.12.1 (was 1 CRITICAL, Go stdlib) - gcr.io/cadvisor/cadvisor v0.49.1 -> ghcr.io/google/cadvisor v0.60.6 (was 5; gcr.io has no newer tag, the project publishes to ghcr.io now) - crazymax/fail2ban 1.1.0 -> 1.1.1 (was 3, openssh-client) Verified with `trivy image --severity CRITICAL` on services: 0 CRITICAL for each new tag. All eight trimmed cAdvisor flags in the compose template still exist in v0.60.6 (checked against `--help`). `docs/tool-versions.yml` pin regex updated for the new cAdvisor path. Not covered here (separate PRs / accepted risk): hugo, watchtower, postfix, lldap, vaultwarden. Review: the cAdvisor jump is large; staging should confirm `container_last_seen{name=...}` still feeds the PostfixDown alert. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
fix(hardening): bump cadvisor, node-exporter and fail2ban off CRITICAL CVEs
All checks were successful
Lint / lint (pull_request) Successful in 1m48s
Details
Secret scan / scan (pull_request) Successful in 25s
Details
2c7d73d4a5
 
The first trivy report (2026-10-13) failed these three on CRITICAL findings.
trivy on the new tags reports 0 CRITICAL for each. cAdvisor moves to
ghcr.io/google/cadvisor (gcr.io has no tag past v0.49.x); all eight trimmed
flags still exist in v0.60.6. tool-versions.yml pin regex follows the new path.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!139
No description provided.