668
Jellyfin critical security update - This is not a joke (github.com)
submitted 7 months ago by to c/selfhosted@lemmy.world
183 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 7 months ago* (5 children)

Implying you have access to some major Docker 0-day exploit, or just talking out of your ass? Because a container is no more or less secure than the machine it runs on. At least if a container gets compromised, it only has access to the volumes you have specifically given it access to. It can’t just run rampant on your entire system, because you haven’t (or at least shouldn’t have) given it access to your entire system.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] -1 points 7 months ago (4 children)

    Docker is known insecure. It doesn't verify any layers it pulls cryptography. The devs are aware. The tickets remain open.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 7 months ago (1 child)

    If that is indeed true it would only mean that the docker container is vulnerable to a supply chain attack. You are not any more vulnerable to a vulnerability in the codebase.

    If you’re using the ghcr image, to post malicious code there, the attack would have already had to compromise their github infra … which would likely result in the attacker being able to push malicious code to git or publish malicious releases. Their linux distro packages are self published via a ppa/install script, which I would assume just pull from their github releases, so a bad github release would immediately be pulled as an update by users just as fast as a container.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •