Merge pull request #290 from almaslennikov/cve-fix-rhel-release

Update packages to fix CVEs in RHEL STIG images

Author: almaslennikov

.gitlab-ci.yml

@@ -32,6 +32,7 @@ variables:  # additional variables are defined at the gitlab group scope
   OPERATOR_IMAGE_NAME: nic-configuration-operator-stig-fips
   DAEMON_IMAGE_NAME: nic-configuration-operator-daemon-stig-fips
   GOV_READY_POLICY_FILE_PATH: pulse-scan-policies/prodsec_approved_govready_release_policy.json
+  CVE_UPDATES_RHEL: "openssl python3-urllib3"
 
 # Common job template for building STIG images
 .build-stig-image:
@@ -162,6 +163,7 @@ build-operator-stig-image-rhel:
       docker build \
         --build-arg GOPROXY=$GOPROXY \
         --build-arg RHEL_STIG_BASE_IMAGE=$RHEL_STIG_BASE_IMAGE \
+        --build-arg CVE_UPDATES_RHEL="$CVE_UPDATES_RHEL" \
         --file      Dockerfile.operator.stig-rhel \
         --tag       $DOCKER_REGISTRY/$OPERATOR_IMAGE_NAME:$DOCKER_TAG-rhel \
         .
@@ -182,6 +184,7 @@ build-daemon-stig-image-rhel:
       docker build \
         --build-arg GOPROXY=$GOPROXY \
         --build-arg RHEL_STIG_BASE_IMAGE=$RHEL_STIG_BASE_IMAGE \
+        --build-arg CVE_UPDATES_RHEL="$CVE_UPDATES_RHEL" \
         --file      Dockerfile.daemon.stig-rhel \
         --tag       $DOCKER_REGISTRY/$DAEMON_IMAGE_NAME:$DOCKER_TAG-rhel \
         .

Dockerfile.daemon.stig-rhel

@@ -44,6 +44,7 @@ RUN --mount=type=cache,target=/go/pkg/mod/ GO_GCFLAGS=${GCFLAGS} make build-daem
 FROM $RHEL_STIG_BASE_IMAGE
 
 ENV MFT_VERSION=4.33.0-169
+ARG CVE_UPDATES_RHEL
 
 ARG DOCA_VERSION=3.2.1
 ARG DOCA_FULL_VERSION=3.2.1-044000-25.10
@@ -71,6 +72,11 @@ RUN curl -fsSL https://www.mellanox.com/downloads/MFT/mft-${MFT_VERSION}-x86_64-
     rm -rf /tmp/mft-${MFT_VERSION}-x86_64-rpm && \
     dnf clean all
 
+RUN if [ -n "${CVE_UPDATES_RHEL}" ]; then \
+        dnf update -y ${CVE_UPDATES_RHEL} && \
+        dnf clean all; \
+    fi
+
 WORKDIR /
 COPY --from=builder /workspace/build/nic-configuration-daemon .
 

Dockerfile.operator.stig-rhel

@@ -44,6 +44,7 @@ RUN --mount=type=cache,target=/go/pkg/mod/ GO_GCFLAGS=${GCFLAGS} make build-mana
 FROM $RHEL_STIG_BASE_IMAGE
 
 ENV MFT_VERSION=4.33.0-169
+ARG CVE_UPDATES_RHEL
 
 # Install MFT (Mellanox Firmware Tools) - amd64/x86_64 only for STIG
 # Note: curl-minimal is already in UBI base image, sufficient for downloads
@@ -55,6 +56,11 @@ RUN dnf install -y kmod && \
     rm -rf /tmp/mft-${MFT_VERSION}-x86_64-rpm && \
     dnf clean all
 
+RUN if [ -n "${CVE_UPDATES_RHEL}" ]; then \
+        dnf update -y ${CVE_UPDATES_RHEL} && \
+        dnf clean all; \
+    fi
+
 WORKDIR /
 COPY --from=builder /workspace/build/manager .