24 lines
1.7 KiB
Markdown
24 lines
1.7 KiB
Markdown
# Upstream sources — rustdesk-server
|
||
|
||
| service | image | source repo | releases / changelog |
|
||
|---------|-------|-------------|----------------------|
|
||
| app | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
|
||
| signal | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
|
||
|
||
- nvd-cpe: rustdesk-server = cpe:2.3:a:rustdesk:rustdesk_server:*:*:*:*:oss:*:*:*
|
||
|
||
## Standing notes
|
||
- Enrolled in the cc-ci weekly set. The NVD CPE above is scoped to the open source server edition;
|
||
do not count RustDesk Client or Server Pro CVEs for this recipe.
|
||
- Both services (`app` = hbbs, `signal` = hbbr) use the SAME image — always bump them together.
|
||
- Docker Hub has stray `1.4.5-*` arch tags (pushed 2026-01-12, top-level `1.4.5` tag deleted, no
|
||
GitHub release) — an aborted/alias push, NOT a real version line. The real line is `1.1.x`;
|
||
GitHub "Latest" + docker `latest` agree (1.1.16 as of 2026-07-20). Ignore 1.4.5.
|
||
- Recipe uses `-k _` on both hbbs and hbbr (enforces key verification, enforced-key mode since
|
||
1.1.11) and publishes host-mode ports 21115-21119 (hbbs) + 21117/21119 (hbbr) — direct
|
||
client connections, only 21118/21119 are the web-socket/http endpoints behind nothing; the
|
||
traefik labels on `app` are vestigial (hbbs has no HTTP :80 service; healthcheck commented out).
|
||
- 1.1.15 raised **default bandwidth limits** and added auth-failure logging (fail2ban-friendly);
|
||
1.1.16 fixed **unauthenticated UDP punch-hole reflection/amplification abuse** + critical `mio`
|
||
0.8.5→0.8.11 issue + i32 overflow (peers offline 24.9–49.7d shown online).
|