Repository navigation
Releases
Releases · guanting112/ubuntu-sys-audit
v0.1.18
Fixed
- Debian version comparison now stops at a NUL byte, as dpkg does. Before, such a version could break the ordering. Found by fuzzing.
- Go version comparison no longer depends on argument order when two prerelease numbers are equal but written differently, such as
rc.1andrc.01. Found by fuzzing. authorized_keyslines: after the key type, the key and comment are split on whitespace alone, as sshd does, so a stray quote can no longer pull spaces into the key. Found by fuzzing.
Added
- A Stack tab listing the databases (PostgreSQL, MySQL, MariaDB, Redis, Valkey, MongoDB, SQLite), language runtimes (Node.js, Python, Ruby, Java, PHP, Go) and servers (nginx, Apache, HAProxy, Docker, containerd) on the host. It finds them in packages, version managers such as nvm, pyenv and SDKMAN!, hand-unpacked installs, Docker containers and running processes, and says whether each listens beyond loopback. A release past its end of life is Medium, or High when it listens beyond loopback. Ubuntu's own packages are not judged by upstream dates. JSON reports carry the list as
stack. - Fuzz tests for the parsers of host content and for both version orders, run with
make fuzz. The Debian order is also checked against dpkg itself.
Full Changelog: v0.1.17...v0.1.18