Closed
Description
Version:
- listmonk: latest
- Deployment: Docker
Description of the bug and steps to reproduce:
By default, the docker-compose.yml configuration exposes PostgreSQL to all network interfaces (0.0.0.0:5432), which can lead to unauthorized access if not secured properly.
Steps to reproduce:
- Deploy Listmonk using the default
docker-compose.yml. - Run the following command to check PostgreSQL's exposure:
sudo netstat -tulnp | grep 5432
Proposed Fix:
Modify docker-compose.yml to explicitly bind PostgreSQL to localhost:
ports:
- "127.0.0.1:5432:5432" # Restrict to localhostAfter applying this change, restart the services:
docker-compose down
docker-compose up -dSecurity Verification
Run:
sudo netstat -tulnp | grep 5432Expected output:
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN