akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity
Files
87590ac4e89498a2d9f1b848f1e2d4004b609042
Charon/docs/security/archive/SECURITY-EXCEPTION-nebula-v1.9.7.md
GitHub Actions 27c252600a chore: git cache cleanup
2026-03-04 18:34:49 +00:00

2.8 KiB
Raw Blame History

Security Exception: Nebula v1.9.7 (GHSA-69x3-g4r3-p962)

Date: 2026-02-10 Status: ACCEPTED RISK CVE: GHSA-69x3-g4r3-p962 Severity: High Package: github.com/slackhq/nebula@v1.9.7 Fixed Version: v1.10.3

Decision

Accept the High severity vulnerability in nebula v1.9.7 as a documented known issue.

Rationale

  • Nebula is a transitive dependency via CrowdSec bouncer -> ipstore chain
  • Upgrading to v1.10.3 breaks compilation:
    • smallstep/certificates removed nebula APIs (NebulaCAPool, NewCAPoolFromBytes, etc.)
    • ipstore missing GetAndDelete method compatibility
  • No compatible upstream versions exist as of 2026-02-10
  • Patching dependencies during build is high-risk and fragile
  • High severity risk classification applies to vulnerabilities within our control
  • This is an upstream dependency management issue beyond our immediate control

Dependency Chain

  • Caddy (xcaddy builder)
    • github.com/hslatman/caddy-crowdsec-bouncer@v0.9.2
      • github.com/hslatman/ipstore@v0.3.0
        • github.com/slackhq/nebula@v1.9.7 (vulnerable)

Exploitability Assessment

  • Nebula is present in Docker image build artifacts
  • Used by CrowdSec bouncer for IP address management
  • Attack surface: [Requires further analysis - see monitoring plan]

Monitoring Plan

Watch for upstream fixes in:

  • github.com/hslatman/caddy-crowdsec-bouncer (primary)
  • github.com/hslatman/ipstore (secondary)
  • github.com/smallstep/certificates (nebula API compatibility)
  • github.com/slackhq/nebula (direct upgrade if dependency chain updates)

Check quarterly (or when Dependabot/security scans alert):

Remediation Trigger

Revisit and remediate when ANY of:

  • caddy-crowdsec-bouncer releases version with nebula v1.10.3+ support
  • smallstep/certificates releases version compatible with nebula v1.10.3
  • ipstore releases version fixing GetAndDelete compatibility
  • GHSA-69x3-g4r3-p962 severity escalates to CRITICAL
  • Proof-of-concept exploit published targeting Charon's attack surface

Alternative Mitigation (Future)

If upstream remains stalled:

  • Consider removing CrowdSec bouncer plugin (loss of CrowdSec integration)
  • Evaluate alternative IP blocking/rate limiting solutions
  • Implement CrowdSec integration at reverse proxy layer instead of Caddy

References

Reference in New Issue View Git Blame Copy Permalink