Skip to content

DEPENDENCY_SECURITY_AUDIT.md

Latest commit

 

History

History
159 lines (124 loc) · 5.31 KB

DEPENDENCY_SECURITY_AUDIT.md

File metadata and controls

159 lines (124 loc) · 5.31 KB
Raw

Dependency Security Audit & Cleanup Report

Executive Summary

This audit addresses security vulnerabilities and dependency management issues in the Stellar Kubernetes Operator. The project has comprehensive security monitoring in place via cargo-deny and cargo-audit, with 23 known advisories currently tracked and justified.

Current Security Posture

✅ Strengths

  • Comprehensive security monitoring via cargo-deny and cargo-audit
  • Well-documented advisory exceptions with justifications
  • License compliance enforcement
  • Explicit crate banning (openssl blocked in favor of rustls)
  • Version pinning for critical security fixes (anyhow 1.0.103, bytes 1.11.1)

⚠️ Areas for Improvement

  • 23 security advisories currently ignored (though most are justified)
  • Some transitive dependencies cannot be upgraded due to ecosystem constraints
  • Major version upgrades needed for wasmtime (24.x → 36.x)
  • Several unmaintained dependencies in the dependency tree

Priority Security Issues

HIGH PRIORITY - Action Required

  1. wasmtime 24.x → 36.x Upgrade

    • Impact: 6 critical vulnerabilities affecting Winch backend (unused by us, but still present)
    • Current: wasmtime 24.0.11, wasmtime-wasi 24.0.11
    • Target: wasmtime ≥36.x
    • Blockers: Breaking API changes require code updates
    • Risk: LOW (vulnerabilities are in unused Winch backend)

  2. rustls-webpki Multiple Versions

    • Impact: TLS certificate parsing vulnerabilities
    • Current: 0.101.7 (via kube-client) + 0.102.8 (via reqwest)
    • Target: ≥0.103.12
    • Blockers: Requires upstream kube-rs and reqwest updates
    • Risk: LOW (we don't process untrusted certificates)

  3. Unmaintained Dependencies

    • backoff 0.4.0 (via kube-runtime)
    • derivative 2.2.0 (via kube-runtime)
    • instant 0.1.13 (via backoff)
    • fxhash 0.2.1 (via wasmtime)
    • paste 1.0.15 (via wasmtime)
    • rustls-pemfile 2.2.0 (via kube-client/axum-server)
    • ttf-parser 0.19.2 (via printpdf)

MEDIUM PRIORITY

  1. Version Pinning Updates

    • Review pinned versions for newer patches
    • anyhow = "1.0.103" - check for 1.0.104+
    • bytes = "1.11.1" - check for newer security patches

  2. Dependency Deduplication

    • Multiple syn versions (1.x vs 2.x ecosystem split)
    • Multiple tokio-util versions
    • Review with cargo tree --duplicates

LOW PRIORITY

  1. Transitive-Only Issues
    • rsa 0.9.10 Marvin Attack (sqlx-mysql only, we use postgres)
    • rand 0.9.2 unsound behavior (testing dependencies only)
    • Various wasmtime Winch backend issues (unused backend)

Hardening Recommendations

1. Automated Security Monitoring

# Add to CI pipeline
cargo deny check
cargo audit --deny warnings

2. Dependency Review Process

  • Require security review for new dependencies
  • Monthly audit of ignored advisories
  • Quarterly major version upgrade assessment

3. Build Hardening

# Add to Cargo.toml profiles
[profile.release]
strip = true          # Remove debug symbols
panic = "abort"       # Don't unwind on panic  
codegen-units = 1     # Better optimization
lto = true            # Link-time optimization

4. Supply Chain Security

  • Pin exact versions in Cargo.lock
  • Use cargo-vet for dependency auditing
  • Implement SBOM generation

Implementation Plan

Phase 1: Immediate Actions (Week 1)

  • Update dependency scanning in CI
  • Review and update pinned security patches
  • Document security review process
  • Add automated security scanning to pre-commit hooks

Phase 2: Ecosystem Dependencies (Weeks 2-4)

  • Evaluate wasmtime 36.x upgrade path
  • Create tracking issues for upstream dependency updates
  • Implement workarounds for unmaintained dependencies where possible

Phase 3: Long-term Hardening (Month 2)

  • Implement SBOM generation
  • Set up automated dependency update PRs
  • Create security baseline documentation
  • Establish quarterly security review process

Testing & Verification

Security Test Suite

# Current commands
cargo deny check
cargo audit 

# Proposed additions  
cargo outdated --root-deps-only
cargo tree --duplicates
cargo vet

Pipeline Integration

  • Block PRs with new security advisories
  • Require security team approval for ignored advisories
  • Automated SBOM generation and publishing

Compliance & Documentation

License Compliance

  • ✅ Comprehensive allowlist in deny.toml
  • ✅ Explicit handling of copyleft licenses
  • ✅ Unicode-DFS-2016 exception documented

Security Documentation

  • Update README with security contact
  • Document security advisory triage process
  • Create SECURITY.md with vulnerability reporting

Risk Assessment

Issue Category Risk Level Justification
Wasmtime vulnerabilities LOW Unused Winch backend only
Unmaintained deps MEDIUM Transitive only, no direct usage
TLS cert parsing LOW No untrusted cert processing
Supply chain LOW Comprehensive scanning in place
License compliance LOW Well-controlled allowlist

Overall Risk Level: LOW to MEDIUM

The project demonstrates strong security awareness with comprehensive monitoring. Most high-severity advisories are appropriately justified as not applicable to production usage patterns.