Skip to content

fix(security): remediate base image CVEs from docker scout scan #42075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
subrata71 merged 2 commits into from
Aug 12, 2026
+16 −4
Merged

fix(security): remediate base image CVEs from docker scout scan #42075

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
36794b6
fix(security): remediate base image CVEs from docker scout scan
subrata71 Jul 31, 2026
2b12c6c
fix(docker): restore the x/text pin and extend it to the mongo-tools …
subrata71 Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions deploy/docker/base.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,30 @@ FROM caddy:builder-alpine AS caddybuilder
# restricted profile with cap-drop ALL). The image binds low ports via
# net.ipv4.ip_unprivileged_port_start, so the setcap is unnecessary.
#
# --replace pins mitigate x/crypto and x/net CVEs from the May 22, 2026
# --replace pins mitigate x/crypto, x/net and x/text CVEs from the May 22, 2026
# coordinated Go security disclosure. None are reachable in Caddy's HTTP
# path (the x/crypto CVEs are all in the SSH subsystem), but scanners
# flag the embedded library version regardless.
#
# Verify these with `go version -m /opt/caddy/caddy`, which prints the effective
# "dep X => Y" pairs. Grepping the binary for module@version strings reports the
# pre-replace version and will make a working pin look inert.
RUN XCADDY_SETCAP=0 xcaddy build \
--with github.com/mholt/caddy-ratelimit \
--replace golang.org/x/crypto=golang.org/x/crypto@v0.52.0 \
--replace golang.org/x/net=golang.org/x/net@v0.55.0
--replace golang.org/x/net=golang.org/x/net@v0.56.0 \
--replace golang.org/x/text=golang.org/x/text@v0.39.0

# Build MongoDB database tools from source with pinned x/crypto and x/net
# Apt-installed mongodb-database-tools ships x/crypto@0.45.0 with no upstream fix available.
FROM golang:1.26.4-alpine AS mongotoolsbuilder
FROM golang:1.26.5-alpine AS mongotoolsbuilder

RUN apk add --no-cache git make bash
WORKDIR /tmp/mongo-tools
RUN git clone --depth 1 --branch 100.17.0 https://github.com/mongodb/mongo-tools.git .
RUN go mod edit -require=golang.org/x/crypto@v0.52.0 \
-require=golang.org/x/net@v0.55.0 && \
-require=golang.org/x/net@v0.56.0 \
-require=golang.org/x/text@v0.39.0 && \
go mod tidy && \
go mod vendor
ENV GOROOT=/usr/local/go
Expand Down Expand Up @@ -67,6 +73,12 @@ RUN set -o xtrace \
mongodb-org-server mongodb-org-mongos mongodb-mongosh \
postgresql-14 \
git tar zstd openssh-client \
# software-properties-common is only needed for the add-apt-repository call above, but it
# pulls in python3-launchpadlib, which drags python3-cryptography, python3-jwt and
# python3-httplib2 into the runtime image and accounts for 12 scanner findings. Purge it
# once the PPA is registered — the sources.list entry and its signing key persist
# independently of the tool that wrote them.
&& DEBIAN_FRONTEND=noninteractive apt-get purge --yes --auto-remove software-properties-common \
&& apt-get clean \
&& rm -rf \
/root/.cache \
Expand Down
Loading