Responding to a vulnerability

This page follows one finding from the notification to the fix.

1. Read the notificationCopy Anchor Link

The notification names the service, the package and the fix, for example "api uses lodash 4.17.20, which has a critical vulnerability. Fixed in 4.17.21. Checked the container: nothing unusual." Open it to land on the finding.

2. Check the findingCopy Anchor Link

The finding shows why it needs action, rule by rule, and the advisory. If your service can't reach the affected code, choose Not affected… and give a reason. Otherwise continue.

3. Read the investigationCopy Anchor Link

If the report has no concerning finding, go to step 4. If it has one, treat the service as compromised and do steps 4 to 7.

4. Update the packageCopy Anchor Link

For services launchroom builds, update the package in your repository. The finding shows a command for your package manager:

pnpm up lodash@^4.17.21

Commit and push. The push deploys the fix. For image services and databases, change the image or the engine version to one with the fix in Settings → Source.

5. Replace the running containersCopy Anchor Link

Redeploy the service. New containers start from the image, and any file someone added to the old ones is gone.

6. Restore dataCopy Anchor Link

If the service can reach a database, restore it from a backup taken before the first sign in the report. The report links to the database's Backups tab. Restore as a new service, check the data, then switch over. See Restore and disaster recovery.

7. Change secretsCopy Anchor Link

Change every secret the report lists in Variables, then deploy. For managed databases, change the database user's password in the database and update the connection variable:

1. Open the database's Data tab or connect with temporary access with writes allowed.
2. Run ALTER USER app WITH PASSWORD '…'; (PostgreSQL) or the equivalent for your engine.
3. Update the password variable of the database service and deploy the services that use it.

8. Block attacksCopy Anchor Link

If the firewall of the service is in Log only, select Turn on blocking.

The finding resolves by itself once the live deployment no longer contains the vulnerable version.