fix cve-2016-2183 (#351)

* fix cve-2016-2183
kubecube-io · Nov 9, 2023 · 0af2896 · 0af2896
1 parent 55cb1ed
commit 0af2896
Show file tree

Hide file tree

Showing 4 changed files with 73 additions and 1 deletion.
diff --git a/docs/changelog.md b/docs/changelog.md
@@ -1,3 +1,22 @@
+# v1.8.11
+
+## BugFix
+- fix cve-2016-2183 [#351](https://github.com/kubecube-io/KubeCube/pull/351)
+
+## Dependencies
+
+- hnc v1.0
+- nginx-ingress v0.46.0
+- helm 3.5
+- metrics-server v0.4.1
+- elasticsearch 7.8
+- kubecube-monitoring 15.4.8
+- thanos 3.18.0
+- logseer v1.0.0
+- logagent v1.0.0
+- kubecube-audit v1.2.0
+- kubecube-webconsole v1.2.4
+
 # v1.8.10
 
 ## BugFix

diff --git a/pkg/apiserver/apiserver.go b/pkg/apiserver/apiserver.go
@@ -18,6 +18,7 @@ package apiserver
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net/http"
 	"time"
@@ -36,6 +37,7 @@ import (
 	"github.com/kubecube-io/kubecube/pkg/clog"
 	"github.com/kubecube-io/kubecube/pkg/utils/constants"
 	_ "github.com/kubecube-io/kubecube/pkg/utils/errcode"
+	"github.com/kubecube-io/kubecube/pkg/utils/safetls"
 
 	"github.com/gin-gonic/gin"
 	swaggerFiles "github.com/swaggo/files"
@@ -131,6 +133,10 @@ func NewAPIServerWithOpts(opts *Config) *APIServer {
 
 	if opts.SecurePort != 0 {
 		s.Server.Addr = fmt.Sprintf("%s:%d", s.Config.BindAddr, s.Config.SecurePort)
+		s.Server.TLSConfig = &tls.Config{
+			PreferServerCipherSuites: true,
+			CipherSuites:             safetls.SafeTlsSuites,
+		}
 	}
 
 	return withSimpleServer(s)

diff --git a/pkg/utils/safetls/safetls.go b/pkg/utils/safetls/safetls.go
@@ -0,0 +1,38 @@
+/*
+Copyright 2023 KubeCube Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package safetls
+
+import "crypto/tls"
+
+var SafeTlsSuites = []uint16{
+	// AEADs w/ ECDHE
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+	tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+
+	// CBC w/ ECDHE
+	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+
+	// AEADs w/o ECDHE
+	tls.TLS_RSA_WITH_AES_128_GCM_SHA256,
+	tls.TLS_RSA_WITH_AES_256_GCM_SHA384,
+
+	// CBC w/o ECDHE
+	tls.TLS_RSA_WITH_AES_128_CBC_SHA,
+	tls.TLS_RSA_WITH_AES_256_CBC_SHA,
+}
diff --git a/pkg/warden/server/apiserver.go b/pkg/warden/server/apiserver.go
@@ -18,11 +18,13 @@ package server
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net/http"
 	"time"
 
 	"github.com/kubecube-io/kubecube/pkg/clog"
+	"github.com/kubecube-io/kubecube/pkg/utils/safetls"
 	"github.com/kubecube-io/kubecube/pkg/warden/reporter"
 	"github.com/kubecube-io/kubecube/pkg/warden/server/authproxy"
 )
@@ -58,7 +60,14 @@ func (s *Server) Run(stop <-chan struct{}) {
 	mux := http.NewServeMux()
 	mux.Handle("/", authProxyHandler)
 
-	s.Server = &http.Server{Handler: mux, Addr: fmt.Sprintf("%s:%d", s.BindAddr, s.Port)}
+	s.Server = &http.Server{
+		Handler: mux,
+		Addr:    fmt.Sprintf("%s:%d", s.BindAddr, s.Port),
+		TLSConfig: &tls.Config{
+			PreferServerCipherSuites: true,
+			CipherSuites:             safetls.SafeTlsSuites,
+		},
+	}
 
 	go func() {
 		err := s.Server.ListenAndServeTLS(s.TlsCert, s.TlsKey)