1
[Urgent] Example Docker self-hosting config exposes Postgres/Redis to the Internet
Source: outline/outline#9392 · opened by @burritosoftware
This is an issue that we only noticed once we started seeing unusually high CPU usage for the Postgres and Redis instances used by Outline. We dug further, and found that Postgres and Redis were open and exposed to the Internet. We isolated them off, and our CPU usage graphs over time was literally a night and day difference, going from 100% spikes every couple seconds to a quiet 3%. There might be more instances running with some variation of the example config that haven't noticed this and have this issue. I have been running an instance of Outline with the provided [example Docker configuration]( and the configuration exposes Postgres and Redis directly to the internet with expose. Along with Postgres having a default "user" and "pass" password (even in docker.env) and Redis having no authentication, this leaves them open to bad actors on the internet for malicious use such as installing malware (most commonly seen is cryptominers). I strongly recomme…
No pledges yet. Be the first to back this.
No comments yet.