The Authelia Docker Image tagged under latest didn’t receive an update over an year, i only see the newest beta releases being updated. Is that a problem security wise, or is it fine letting that run until the next release?

  • n0xew
    link
    English
    610 months ago

    There hasn’t been any release since a year either, the last one being 4.37.5 https://github.com/authelia/authelia/releases

    But you can have a look at the github milestones, 4.38.0 is in the work and hopefully will be released sooner than later https://github.com/authelia/authelia/milestone/17

    Regarding security: a quick browsing in the project’s issues, filtering by area:security did not show any flaws being reported since the last release. But there may have been undisclosed vulnerabilities the project’s dev are working on fixing for the next version. My personal non-professional non-legally-binding opinion is that it looks fine, so I do keep it running on my server.

    • @[email protected]
      link
      fedilink
      English
      910 months ago

      The problem is, the libraries and SDK used to build the app will have had vulnerabilities for sure. Same for the underlying image (unless scratch / distroless). We run extensive vulnerability scanning in our pipelines, and Go libs occasionally pop up. The Go SDK also had multiple security fixes in the last year.

    • MoriceOP
      link
      fedilink
      English
      210 months ago

      thanks for the insight, i was just worried that the libraries in the container image are outdated and could include some vulnerabilities, but it’s alpine based and uses musl which seems hadn’t a CVE for a while.

  • @[email protected]
    link
    fedilink
    English
    310 months ago

    I literally just finished setting up an nginx server with authentication to avoid authelia

  • @[email protected]
    link
    fedilink
    English
    310 months ago

    I’m not using Authelia myself but I don’t think you’d need to run beta releases to get security patches.