TLS certificate with hardcoded private key in postgres Docker Hub image
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by inspecting the image build for how /etc/ssl/private/ssl-cert-snakeoil.key, /etc/ssl/certs/ssl-cert-snakeoil.pem, and postgresql-common/root.crt enter the image. Check whether the private key is present in the built image and determine a safe initialization-time approach; done means no pregenerated private key is shipped while the default PostgreSQL image behavior remains unchanged.
Written by the indexing model from the issue text.
Description
I checked a couple of top images on Docker Hub for pregenerated / hardcoded private keys and noted that the "postgres" images (which is a "Docker Official Image") contain a pregenerated "snakeoil" certificate and private key:
/etc/ssl/private/ssl-cert-snakeoil.key
/etc/ssl/certs/ssl-cert-snakeoil.pem
Those snakeoil certs are autogenerated by Debian, but they are not supposed to be hardcoded. Instead, keys should be generated
on instantiating a container from an image.
The security risk is somewhat limited, as the postgres image does not appear to directly enable TLS, so the certificate is not used in the default configuration. It is however referenced in the config file postgresql-common/root.crt, so it looks like it could easily get enabled and used.
(I reported this to Docker's security contact, but was asked to report it here due to the low security risk. More generally, I think it's worth considering having some safeguards against this for all Docker images, e.g., by auto-scanning them for common pregenerated key paths. But not sure if this is the right place to discuss this.)
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
docker-library/postgres#1355 · 10 comments · 11 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1349 · 2 comments ·
All issues in docker-library/postgres
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100