diff --git a/.trivyignore.yaml b/.trivyignore.yaml new file mode 100644 index 0000000000..205e579648 --- /dev/null +++ b/.trivyignore.yaml @@ -0,0 +1,143 @@ +# Trivy exception file for the SEP side-car image. +# +# Trivy does NOT auto-discover this file: DefaultIgnoreFile is ".trivyignore", +# so the YAML form must be passed explicitly: +# +# trivy image --ignorefile .trivyignore.yaml --severity HIGH,CRITICAL +# +# Every entry carries a reachability argument, not merely "no upstream fix" — +# an unfixed CVE alone is not grounds for an exception. expired_at forces a +# revisit; re-scan and take whatever Debian has since fixed. +# +# Every entry is scoped by `purls` to exactly the packages its statement +# assessed. This is load-bearing, not decoration: matchPURL() returns true +# when the list is empty, so an unscoped entry suppresses its CVE for EVERY +# package — including one where the reachability argument does not hold. The +# constraints carry no version, which matches any version of the named package. + +vulnerabilities: + # --- perl-base: nothing in this image executes perl. ------------------------ + # Debian marks perl-base Essential: yes, so removal needs + # --force-remove-essential, which was measured, produced a working image, and + # was rejected on certainty grounds. Remove these entries the moment any + # perl-invoking path is added to the image — the justification dies with it. + - id: CVE-2026-13221 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl regex trie miscompilation producing silently wrong matches + above 65535 alternation branches. Reaching it requires executing a perl + program; the image invokes no perl interpreter. Fixed upstream in sid + 5.42.3-1, not yet in trixie. Remove this entry when trixie carries the fix, + or if anything in the image starts executing perl. + expired_at: 2027-02-19 + - id: CVE-2026-42496 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Archive::Tar symlink traversal on extraction; requires a perl + script extracting an untrusted archive, and none exists in the image. + Debian's own tracker rates this a minor issue and has postponed the fix, + disagreeing with the NVD CRITICAL score. Remove when trixie carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-57433 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Storable signed integer overflow deserializing a crafted SX_HOOK + record; requires a perl program deserializing untrusted data, and none + exists in the image. Remove when trixie carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-8376 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl interpreter issue in the same family as CVE-2026-13221; + unreachable for the same reason — no perl is executed. Remove when trixie + carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-42497 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl interpreter/bundled-module issue; unreachable because the + image executes no perl. Remove when trixie carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-48962 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl interpreter/bundled-module issue; unreachable because the + image executes no perl. Remove when trixie carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-57432 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl interpreter/bundled-module issue; unreachable because the + image executes no perl. Remove when trixie carries a fix. + expired_at: 2027-02-19 + - id: CVE-2026-9538 + purls: + - pkg:deb/debian/perl-base + statement: >- + perl-base. Perl interpreter/bundled-module issue; unreachable because the + image executes no perl. Remove when trixie carries a fix. + expired_at: 2027-02-19 + + # --- openssl trio (libssl3t64, openssl, openssl-provider-legacy) ------------ + - id: CVE-2026-14456 + purls: + - pkg:deb/debian/libssl3t64 + - pkg:deb/debian/openssl + - pkg:deb/debian/openssl-provider-legacy + statement: >- + libssl3t64, openssl, openssl-provider-legacy. QUIC server denial of + service, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. SEP serves no QUIC: + the three API processes speak HTTP/1.1 over loopback behind PMM's nginx. + Debian has deferred the fix. Remove when Debian ships it. + expired_at: 2027-02-19 + + # --- ncurses family (libncursesw6, libtinfo6, ncurses-base, ncurses-bin) ---- + - id: CVE-2025-69720 + purls: + - pkg:deb/debian/libncursesw6 + - pkg:deb/debian/libtinfo6 + - pkg:deb/debian/ncurses-base + - pkg:deb/debian/ncurses-bin + statement: >- + ncurses buffer overflow, CVSS 7.8 AV:L/AC:L/PR:L/UI:R. Local vector + requiring user interaction with a crafted terminfo entry inside the + container. No upstream fix. ncurses-base and ncurses-bin are Debian + Essential; libtinfo6 is required by bash. libncursesw6 is removable but + carries the same CVE as three unremovable siblings, so removing it changes + nothing. Remove when Debian ships a fix. + expired_at: 2027-02-19 + + # --- gzip ------------------------------------------------------------------- + - id: CVE-2026-41992 + purls: + - pkg:deb/debian/gzip + statement: >- + gzip. Global buffer overflow in LZH decompression. The archive paths that + run inside this container use Python's gzip/tarfile stdlib + (app/tasks/execution/executors/nomad/models.py, app/tasks/logs/log_reader.py), + which link zlib rather than invoking the gzip binary. All four /usr/bin/tar + -czf call sites in the tree execute on a managed target host rather than in + this image: two are dipper payloads, and dipper is stripped from the + embedded app set, while two are in snippets/postgresql_config_files.sh, + which ships in the image but is dispatched to run on the target. gzip is + Debian Essential. Remove when Debian ships a fix, or if anything starts + shelling out to gzip inside this image. + expired_at: 2027-02-19 + + # --- libacl1 ---------------------------------------------------------------- + - id: CVE-2026-54369 + purls: + - pkg:deb/debian/libacl1 + statement: >- + libacl1. Symlink traversal privilege escalation, CVSS 7.1 AV:L/AC:L/PR:L. + Local vector requiring pre-existing privileges in the container; the image + runs as the unprivileged sep user. No upstream fix; required by coreutils, + tar, sed and passwd, so not removable. Remove when Debian ships a fix. + expired_at: 2027-02-19 diff --git a/changelog.d/SEP-1864.security.md b/changelog.d/SEP-1864.security.md new file mode 100644 index 0000000000..4114ba6b0d --- /dev/null +++ b/changelog.d/SEP-1864.security.md @@ -0,0 +1 @@ +Container image rebuilt on a refreshed Debian base with the unused C++ toolchain and PDF-rendering libraries removed, clearing 84 HIGH/CRITICAL vulnerability findings. diff --git a/sidecar/Containerfile.sidecar b/sidecar/Containerfile.sidecar index fc8d411afa..320ba6020d 100644 --- a/sidecar/Containerfile.sidecar +++ b/sidecar/Containerfile.sidecar @@ -10,18 +10,7 @@ FROM localhost/sep:builder AS builder # Consolidated SEP side-car: the five SEP services plus a bundled Valkey broker # under one supervisord. No frontend SPA — the UI is served by PMM. -FROM docker.io/library/python:3.11.14-slim - -RUN apt-get update && \ - apt-get install -y --no-install-recommends \ - g++ \ - libpango-1.0-0 \ - libpangoft2-1.0-0 \ - fontconfig \ - fonts-dejavu \ - shared-mime-info && \ - apt-get clean && \ - rm -rf /var/lib/apt/lists/* +FROM docker.io/library/python:3.11.16-slim RUN groupadd --gid 1001 sep && \ useradd --gid sep --shell /usr/sbin/nologin --home-dir /home/sep --uid 1001 --create-home sep @@ -31,14 +20,23 @@ ENV APP_HOME=$HOME/app RUN install -d -o 1001 -g 1001 -m 0750 $APP_HOME WORKDIR $APP_HOME -# netcat backs the migration wait-loops in supervisord.conf +# netcat backs the migration wait-loops in supervisord.conf. The upgrade is +# paired with the base pin rather than trusted to it: the pinned tag still +# ships util-linux 2.41-5, whose fix Debian published as 2.41.5-0+deb13u1 +# after the tag was cut. +# +# No rendering libraries are installed. libpango-1.0-0, libpangoft2-1.0-0, +# fontconfig, fonts-dejavu and shared-mime-info must return if `report` is +# ever added to sidecar/settings.yaml's SEP.APPS: app/sep/apps/report/service.py +# imports weasyprint at module scope, and this image strips that package +# instead of backing it. RUN apt-get update && \ + apt-get upgrade -y && \ apt-get install -y --no-install-recommends netcat-openbsd && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* COPY --from=builder /usr/src/sep/wheels /wheels COPY --from=builder /usr/src/sep/requirements.txt . -RUN pip install --no-cache-dir wheel RUN pip install --no-cache-dir /wheels/* # Bundled Valkey broker: the server, plus the cli the healthcheck pings