Skip to content

Commit c9cada9

Browse files
sunilarjunsunilarjun
committed
Adding Security Advisories and CVES section, and adding updates to v5.4 folder.
Signed-off-by: Sunil Singh <[email protected]>
1 parent 3222a22 commit c9cada9

File tree

5 files changed

+117
-1
lines changed

5 files changed

+117
-1
lines changed

‎docs/14.releasenotes/01.5x/Exposure-ManagerContainerLogs.md‎ renamed to ‎docs/16.security_advisories/01.security_advisories/Exposure-ManagerContainerLogs.md‎

File renamed without changes.

‎docs/16.security_advisories/16.security_advisories.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: UI Extension
3+
sidebar_label: 16. Security Advisories and CVEs
4+
taxonomy:
5+
category: docs
6+
slug: /ui_extension
7+
---
8+
9+
This section describes security advisories and CVEs for NeuVector.

‎versioned_docs/version-5.4/14.releasenotes/01.5x/01.5x.md‎

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,51 @@ slug: /releasenotes/5x
1111
To receive email notifications of new releases, please subscribe to this SUSE mailing list: https://lists.suse.com/mailman/listinfo/neuvector-updates
1212
:::
1313

14+
#### 5.4.5 July 2025
15+
16+
##### New Features:
17+
18+
* **NVSHAS-9776**: Add etcd toleration in helm chart.
19+
20+
##### Bug Fixes:
21+
22+
* **NVSHAS-9507**: OCI container not getting scanned.
23+
* **NVSHAS-9787**: Remove unnecessary manager log.
24+
* **NVSHAS-9788**: Refine algorithm for generating certificate.
25+
* **NVSHAS-9789**: Remove unnecessary manager log on remote registry configuration.
26+
* **NVSHAS-9867**: NeuVector shows `.NET Library System.Formats.Asn1 v8.013` affected CVE 2024-38095.
27+
* **NVSHAS-9883**: [quay.io]Wildcard filters not working for docker registry.
28+
* **NVSHAS-9911**: Scanning the repo using REST API results in an incorrect "message"
29+
* **NVSHAS-9930**: CVE-2018-20796 for `glibc/libc-bin : 2.36-9+deb12u10` - False positive.
30+
* **NVSHAS-9933**: Registry-adapter feature (Harbor) showing errors in target registry while scanning.
31+
* **NVSHAS-9934**: Suspected zero-drift functionality malfunction.
32+
* **NVSHAS-9940**: NV scan JFrog Subdomain mode issue.
33+
* **NVSHAS-9942**: Images scans for customer images are failing.
34+
* **NVSHAS-9945**: When the process name is too long, it's difficult to determine how to create the appropriate process profile rule.
35+
* **NVSHAS-9946**: Display issue with Admission Control alert for Credential Type.
36+
* **NVSHAS-9947**: [UI-ext] Compliance Chart Missing "Manual" Status in Rancher NeuVector.
37+
* **NVSHAS-9948**: After upgrading to `5.4.3` NeuVector configuration has been lost.
38+
* **NVSHAS-9949**: [Harbor][Incorrect user/pw] It still scan images even inputting incorrect user/pw.
39+
* **NVSHAS-9952**: Remove 'signature' from usage report because NV no longer issues/checks the license key.
40+
* **NVSHAS-9953**: Pods Enforcer keeps restarting.
41+
* **NVSHAS-9954**: NeuVector prometheus-exporter generating duplicated metrics.
42+
* **NVSHAS-9958**: Network rule enforcement takes long time.
43+
* **NVSHAS-9960**: Scanners not working.
44+
* **NVSHAS-9969**: fatal error: concurrent map writes results in enforcer component restart.
45+
* **NVSHAS-9971**: NV UI about `Get Bootstrap Password`.
46+
* **NVSHAS-9975**: [Manager] TypeError: `this.mousemoveListener` is not a function is observed on the NV GUI.
47+
* **NVSHAS-9986**: Process profile rules and File access rules cannot be edited and removed in Federated policy group view.
48+
* **NVSHAS-9988**: UI: Group pages is not showing all groups when more than 2k groups present.
49+
* **NVSHAS-9991**: The group `nv.gatekeeper-controller-manager.openshift-azure-guardrails` is missing from UI.
50+
* **NVSHAS-9993**: Replace md5 by sha256.
51+
* **NVSHAS-9994**: The enforcer pod keeps restarting.
52+
* **NVSHAS-9996**: NeuVector Helm chart should allow non-privileged mode of enforcer pods.
53+
* **NVSHAS-9998**: Cannot export group from Neuvector federated master.
54+
* **NVSHAS-10000**: Upgrade NV to BCI 15.7.
55+
* **NVSHAS-10003**: Reload page does not work on standalone NV page while a Rancher UI is opening.
56+
* **NVSHAS-10008**: Registry Scan - View menu is broken for Scanned Image.
57+
* **NVSHAS-10010**: TCP SYN Flood blocks ingress causing complete ingress traffic being blocked.
58+
1459
#### 5.4.4 May 2025
1560

1661
##### New Features:
@@ -134,7 +179,7 @@ In the NeuVector 5.4.2 release, support is discontinued for deployments using th
134179

135180
Please create and configure internal certificates from the scanner for the controller, enforcer, and registry-adapter to achieve a rolling update without losing data. It is still recommended to take a backup of your configuration before upgrading.
136181

137-
The following steps are only needed if your deployment uses a `.yaml` file. Upgrading using Helm does not need these additional steps due to the internal certificates getting created by default via the following flags: `internal.autoGenerateCert` and `internal.autoRotateCert`.
182+
The following steps are only needed if your deployment uses a `.yaml` file. Upgrading using Helm does not need these additional steps due to the internal certificates getting created by default via the following flags: `internal.autoGenerateCert` and `internal.autoRotateCert`.
138183

139184
```shell
140185
docker run -it --entrypoint=bash neuvector/scanner:3.654 -c "cat /etc/neuvector/certs/internal/ca.cert" > ca.crt

‎versioned_docs/version-5.4/16.security_advisories/01.security_advisories/Exposure-ManagerContainerLogs.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Sensitive information exposure in NeuVector manager container logs
2+
3+
**CVE ID:** CVE-2025-46808
4+
**CVSS Score:** 6.8- [AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N&version=3.1)
5+
**CWE:** [CWE-532: Insertion of Sensitive Information into Log File](https://cwe.mitre.org/data/definitions/532)
6+
7+
**Affected Versions**
8+
9+
* All versions earlier than `5.0.0`
10+
* Versions from `5.0.0` up to and including `5.4.4`
11+
12+
**Fixed version: `5.4.5`**
13+
14+
### **Impact**
15+
16+
A vulnerability has been identified in the NeuVector version up to and including `5.4.4`, where sensitive information is leaked into the manager container’s log. The listed fields can be caught in the log:
17+
18+
| Field | Field Description | Where it Appears | Reproduction | Environment |
19+
| :---- | :---- | :---- | :---- | :---- |
20+
| `X-R-Sess` | Rancher’s session token for single sign on token | Request header | Log in via Rancher UI and access NeuVector SSO | Rancher with NeuVector SSO |
21+
| `personal_access_token` | The Github / Azure DevOps token | Request body | Submit remote repository config under *Configuration \> Settings* | NeuVector |
22+
| `token1.token` | NeuVector user’s session token | Response body | Send GET request through NeuVector web server’s API: `https://<neuvector ui’s url>/user?name=<username>` | NeuVector |
23+
| `rekor_public_key`, `root_cert`, `sct_public_key` | Rekor public key, Root certificate, Signed certificate timestamp(SCT) Public Key in private root of trust | Request body | Create/update private root of trust from Sigstore page | NeuVector |
24+
| public\_key | Verifier’s public key | Request body | Create/update verifier in Sigstore page | NeuVector |
25+
26+
:::note
27+
**Note:** NeuVector installations not using the single sign-on integration with Rancher Manager, and does not have Remote Repository Configuration enabled, are not affected by this issue.
28+
:::
29+
30+
In the patched version, X-R-Sess is partially masked so that users can confirm what it is being used while still keeping it safe for consumption. The log which includes `personal_access_token`, `token`, `rekor_public_key`, `root_cert`, `sct_public_key`, `public key` are removed, as the request body is not mandatory in the log.
31+
32+
:::note
33+
* The severity of the vulnerability depends on your logging strategy.
34+
* **Local logging (default)**: Limits exposure of impact.
35+
* **External logging**: Vulnerability’s severity increases, the impact depends on security measures implemented at the external log collector level.
36+
* The final impact severity for confidentiality, integrity and availability is dependent on the permissions that the leaked credentials have on their own services.
37+
38+
Please consult the associated [Unsecured credentials](https://attack.mitre.org/techniques/T1552/) for further information about this category of attack.
39+
40+
### **Patches**
41+
42+
Patched versions include release `5.4.5` and above. Users are advised to rotate the GitHub token used in Remote Repository Configuration once they have upgraded to a fixed version.
43+
44+
### **Workarounds**
45+
46+
No workarounds are currently available. Customers are advised to upgrade to a fixed version at their earliest convenience.
47+
48+
If you have any questions or comments about this advisory:
49+
50+
* Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
51+
* Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
52+
* Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
53+

‎versioned_docs/version-5.4/16.security_advisories/16.security_advisories.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: UI Extension
3+
sidebar_label: 16. Security Advisories and CVEs
4+
taxonomy:
5+
category: docs
6+
slug: /ui_extension
7+
---
8+
9+
This section describes security advisories and CVEs for NeuVector.

0 commit comments

Comments
 (0)