Skip to content

security: harden TLS minimum version and k8s seccomp profiles (Fortify SCA triage)#7669

Merged
coskunaydinoglu merged 6 commits into
masterfrom
claude/funny-thompson-UqmzW
Jun 9, 2026
Merged

security: harden TLS minimum version and k8s seccomp profiles (Fortify SCA triage)#7669
coskunaydinoglu merged 6 commits into
masterfrom
claude/funny-thompson-UqmzW

Conversation

@coskunaydinoglu

Copy link
Copy Markdown
Contributor

DO NOT MERGE — opened for review/discussion of the Fortify static-analysis triage. Draft.

Summary

Triage and partial remediation of the Fortify SCA report (scan 2026‑06‑01, 58 findings: 23 Critical / 12 High / 7 Medium / 16 Low). Each finding was audited against the current tree (the scan was from an older snapshot — many line numbers no longer match).

Full per-finding write-up: SECURITY_REVIEW_Fortify_2026-06-02.md.

Disposition Count
Fixed in this PR 7
Already mitigated / false positive 36
Accepted risk / operational / not safely fixable in code 15

Changes in this PR

Insecure Transport: Weak SSL Protocol — Critical ×2

api/api.js, frontend/express/app.js: enforce minVersion: "TLSv1.2" on both HTTPS listeners so Node no longer negotiates down to SSLv3/TLSv1.0/TLSv1.1.

Kubernetes Improper Deployment/StatefulSet Access Control — High ×4

Added pod-level securityContext.seccompProfile.type: RuntimeDefault to the api, frontend, ingestion Deployments and the mongo StatefulSet.

Explicitly not changed (see report for rationale)

  • Weak Hash MD5/SHA‑1 ×15 — non-cryptographic use (persisted collection-name / device / cohort IDs); changing breaks existing data. crashes-jira RSA‑SHA1 is mandated by the Jira OAuth1 API.
  • Path Manipulation / XSS / Privacy Violation (Critical) — guards already present in current code (allow-lists, resolvePathInBase, Express {root} traversal rejection, delete password/api_key before output).
  • USER root, apt pinning, Tiller RBAC, CORS header, HTTP fallback, postMessage *, CI test password — by-design, config-driven, test-only, or belong upstream / in a Helm-3 migration. 5 owner follow-ups listed in the report.

Verification

node --check api/api.js                # OK
node --check frontend/express/app.js   # OK
yaml.safe_load_all × 4 manifests       # OK

🤖 Generated with Claude Code

https://claude.ai/code/session_012mFAbw8FoSFhsMaRRNHzx3


Generated by Claude Code

Address Fortify SCA findings (scan 2026-06-01):

- Insecure Transport: Weak SSL Protocol (Critical x2): enforce
  minVersion TLSv1.2 on the API and frontend HTTPS listeners so Node
  no longer negotiates down to SSLv3/TLSv1.0/TLSv1.1.
- Kubernetes Improper Deployment/StatefulSet Access Control (High x4):
  add pod-level seccompProfile RuntimeDefault to the api, frontend,
  ingestion Deployments and the mongo StatefulSet.

Adds SECURITY_REVIEW_Fortify_2026-06-02.md triaging all 58 findings
(7 fixed, 36 already-mitigated/false-positive, 15 accepted/operational).

https://claude.ai/code/session_012mFAbw8FoSFhsMaRRNHzx3
Per review feedback: some deployments still require older TLS versions
and many terminate TLS at nginx/their webserver, so the API and frontend
HTTPS servers must not hardcode minVersion TLSv1.2.

Replace the forced minVersion with optional ssl.minVersion / ssl.maxVersion
config keys (documented in both config.sample.js files). When unset -- the
default -- Node keeps its built-in protocol range, so behavior is unchanged
for existing deployments; operators who want to enforce a floor can opt in.

k8s seccompProfile hardening retained.

https://claude.ai/code/session_012mFAbw8FoSFhsMaRRNHzx3
@coskunaydinoglu coskunaydinoglu marked this pull request as ready for review June 9, 2026 09:19
Copilot AI requested a review from can-angun June 9, 2026 09:51
@coskunaydinoglu coskunaydinoglu enabled auto-merge June 9, 2026 14:41
@coskunaydinoglu coskunaydinoglu merged commit ee5df09 into master Jun 9, 2026
9 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants