@Rocky there are a few critical and high vulnerabilities consistent across releases and even more vulnerabilities in 4.1.0-rc01. Where can I find the security scans for each release? Some examples: • GHSA-c87w-642h-m97h org.apache.ranger:ranger-plugins-common • GHSA-r7pg-v2c8-mfg3 org.apache.avro:avro

Hello! I'm Rocky. Regarding your question about security scans and vulnerabilities: StarRocks does not currently publish a standalone, public dashboard of security scan reports (like Snyk or Trivy) for every individual release in its documentation. However, security is a high priority for the project, and here is how these vulnerabilities are managed: 1. Release Notes: Critical and high-severity vulnerabilities (CVEs/GHSAs) that have been addressed are explicitly listed in the Release Notes. For example, version 3.3.17 fixed several CVEs related to dependencies like HttpClient5 and Parquet. 2. Dependency Management: Vulnerabilities such as GHSA-c87w-642h-m97h (Apache Ranger) and GHSA-r7pg-v2c8-mfg3 (Apache Avro) are typically resolved by upgrading the underlying third-party libraries in the StarRocks source code. 3. Release Candidates (RC): Version 4.1.0-rc01 is a "Release Candidate," which is specifically intended for community testing. It is common for vulnerabilities in dependencies to be identified during this phase and addressed before the final General Availability (GA) release. 4. GitHub Security Advisories: The official place to find and track security-related disclosures is the StarRocks GitHub Security page. 5. Reporting: If you have specific scan results for 4.1.0-rc01, the best way to ensure they are addressed is to: * Open an issue on the StarRocks GitHub repository. * Reach out in the

#security

or

#contributing

channels on the StarRocks Slack. If you need help checking if a specific GHSA has a planned fix in the upcoming 4.1.0 GA release, I can help you look through recent pull requests! References • administration/management/monitoring/Monitor_and_Alert.md • administration/management/FE_configuration.md

@Rocky I see that there is a trivy.yaml file in the starrocks github repo. The results of such scans are private?

The

trivy.yaml

file in the StarRocks GitHub repository is part of the project's Continuous Integration (CI) and security hardening process. Here is how the visibility and results of these scans generally work: *1. Scan Execution (Public)* Because StarRocks is an open-source project, the GitHub Actions workflows that trigger these scans are typically public. You can see the "Security" or "CI" workflows running in the Actions tab of the repository. The logs showing that a scan was performed are usually visible to everyone. *2. Detailed Results (Private/Restricted)* While the fact that a scan ran is public, the detailed security alerts generated by tools like Trivy (which identifies CVEs in dependencies or container images) are typically managed through the GitHub Security tab. * Maintainer Access: By default, detailed vulnerability reports in the "Security" tab are restricted to repository maintainers. This is a standard security practice to prevent "zero-day" exploits, allowing developers to patch vulnerabilities before the details are made public. * Public Summaries: High-level summaries or resolved security issues are often documented in release notes or the project's

SECURITY.md

file. *3. Purpose of `trivy.yaml`* The presence of this file indicates that the StarRocks team proactively monitors: * Container Image Vulnerabilities: Ensuring the official Docker images are safe. * Dependency Scanning: Checking for known vulnerabilities in third-party libraries (Go, Java, C++, etc.). * Configuration Misconfigurations: Checking for security risks in the infrastructure-as-code or deployment files. How to report a security issue? If you have found a security vulnerability yourself, it is recommended not to open a public issue. Instead, look for the

SECURITY.md

file in the repository, which provides instructions on how to report vulnerabilities privately to the security team. In summary: The infrastructure for scanning is public, but the specific, actionable vulnerability data is generally kept private to maintainers until a fix is available. References • sql-reference/System_variable.md • deployment/environment_configurations.md • administration/management/FE_configuration.md • administration/management/monitoring/Monitor_and_Alert.md • sql-reference/sys/policy_references.md • administration/user_privs/authorization/ranger_plugin.md