this post was submitted on 19 Feb 2024
7 points (76.9% liked)

Selfhosted

40329 readers
638 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
7
Authelia Docker Image outdated? (lemmy.thenewgaming.de)
submitted 9 months ago by morice@lemmy.thenewgaming.de to c/selfhosted@lemmy.world
7 comments fedilink hide all child comments
 

The Authelia Docker Image tagged under latest didn't receive an update over an year, i only see the newest beta releases being updated. Is that a problem security wise, or is it fine letting that run until the next release?

top 7 comments
sorted by: hot top controversial new old
[–] n0xew@lemmy.world 5 points 9 months ago (2 children)

There hasn't been any release since a year either, the last one being 4.37.5 https://github.com/authelia/authelia/releases

But you can have a look at the github milestones, 4.38.0 is in the work and hopefully will be released sooner than later https://github.com/authelia/authelia/milestone/17

Regarding security: a quick browsing in the project's issues, filtering by area:security did not show any flaws being reported since the last release. But there may have been undisclosed vulnerabilities the project's dev are working on fixing for the next version. My personal non-professional non-legally-binding opinion is that it looks fine, so I do keep it running on my server.

[–] khorak@lemmy.dbzer0.com 9 points 9 months ago

The problem is, the libraries and SDK used to build the app will have had vulnerabilities for sure. Same for the underlying image (unless scratch / distroless). We run extensive vulnerability scanning in our pipelines, and Go libs occasionally pop up. The Go SDK also had multiple security fixes in the last year.

[–] morice@lemmy.thenewgaming.de 2 points 9 months ago (1 children)

thanks for the insight, i was just worried that the libraries in the container image are outdated and could include some vulnerabilities, but it's alpine based and uses musl which seems hadn't a CVE for a while.

[–] vegetaaaaaaa@lemmy.world 2 points 9 months ago

i was just worried that the libraries in the container image are outdated

They actually are: trivy scan on authelia/authelia:latest https://pastebin.com/raw/czCYq9BF

[–] doeknius_gloek@discuss.tchncs.de 3 points 9 months ago

I'm not using Authelia myself but I don't think you'd need to run beta releases to get security patches.

[–] ryannathans@aussie.zone 3 points 9 months ago (1 children)

I literally just finished setting up an nginx server with authentication to avoid authelia