Skip to content

fix(docker): upgrade curl and OpenSSL explicitly so a cached layer can't keep old ones #648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Medformatik merged 1 commit into from
Oct 26, 2026
Merged

fix(docker): upgrade curl and OpenSSL explicitly so a cached layer can't keep old ones #648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions apps/api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,9 +145,16 @@ WORKDIR /app
# socket became reachable.
# The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456, and git
# pulls in libexpat, whose CVE-2026-66046 fix landed after this base was cut.
# curl pulls in brotli-libs; 1.2.1-r0 fixes CVE-2026-111497.
# curl pulls in brotli-libs; 1.2.1-r0 fixes CVE-2026-111497. curl and libcurl
# 8.23.0-r0 fix CVE-2026-92392. `apk add` alone is not enough: a release build
# can restore this layer from the registry build cache with the curl it held
# then. Naming curl here, and the version floor checked after, change this
# instruction, which keeps such a layer from being reused; the floor also
# fails the build on a mirror that doesn't have the fix yet.
RUN apk add --no-cache curl ca-certificates git && \
apk upgrade --no-cache libcrypto3 libssl3 libexpat brotli-libs && \
apk upgrade --no-cache libcrypto3 libssl3 libexpat brotli-libs curl libcurl && \
libcurl="$(apk query --fields version libcurl)" && libcurl="${libcurl#Version: }" && \
test -n "$libcurl" && test "$(apk version -t "$libcurl" 8.23.0-r0)" != "<" && \
rm -rf /usr/local/lib/node_modules/npm && \
rm -f /usr/local/bin/npm /usr/local/bin/npx

Expand Down
15 changes: 12 additions & 3 deletions apps/ops-agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,10 +90,19 @@ RUN node scripts/copy-runtime-packages.mjs /tmp/runtime-packages.json /app /runt
# dependencies, out of the shipped image.
FROM node:24.22.1-alpine@sha256:6a1c190e17215d844926b0677f4bf87273ff7d5e54db06d3b5b5863ab0b09a3d AS runner
WORKDIR /app
# The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456.
# The pinned base predates Alpine's OpenSSL fix for CVE-2026-14456. curl and
# libcurl 8.23.0-r0 fix CVE-2026-92392.
# git fetches community service repositories into the agent's community store.
RUN apk upgrade --no-cache libcrypto3 libssl3 && \
apk add --no-cache ca-certificates curl docker-cli docker-cli-compose git tini && \
# The upgrade runs after the install: `apk upgrade` of a package that isn't
# installed yet does nothing. `apk add` alone is not enough: a release build can
# restore this layer from the registry build cache with the curl it held then.
# Naming curl in the upgrade, and the version floor checked after, change this
# instruction, which keeps such a layer from being reused; the floor also fails
# the build on a mirror that doesn't have the fix yet.
RUN apk add --no-cache ca-certificates curl docker-cli docker-cli-compose git tini && \
apk upgrade --no-cache libcrypto3 libssl3 curl libcurl && \
libcurl="$(apk query --fields version libcurl)" && libcurl="${libcurl#Version: }" && \
test -n "$libcurl" && test "$(apk version -t "$libcurl" 8.23.0-r0)" != "<" && \
rm -rf /usr/local/lib/node_modules/npm && \
rm -f /usr/local/bin/npm /usr/local/bin/npx

Expand Down
12 changes: 8 additions & 4 deletions apps/transitous-runner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,13 +84,17 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]

# git is required because the upstream attribution script reads the catalog's
# submodule metadata; there is no credential helper and no remote configured.
# Explicitly upgrade PCRE2 and Expat inherited from the pinned base to their
# security fixes. The version check fails a stale mirror and, when raised,
# invalidates this layer in the registry build cache.
# Explicitly upgrade PCRE2 and Expat inherited from the pinned base, and
# libssl3 and openssl (3.0.22-1~deb12u2 fixes CVE-2026-84782) that curl, git,
# Python and ca-certificates pull in, to their security fixes. The version
# checks fail a stale mirror and, when raised, invalidate this layer in the
# registry build cache.
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
ca-certificates curl git python3 python3-pip python3-venv age libpcre2-8-0 libexpat1 \
ca-certificates curl git python3 python3-pip python3-venv age libpcre2-8-0 libexpat1 libssl3 openssl \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge 2.5.0-1+deb12u5 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge 3.0.22-1~deb12u2 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge 3.0.22-1~deb12u2 \
&& apt-get clean -y \
&& rm -rf /var/lib/apt/lists/* \
&& rm -f /usr/lib/python3.*/EXTERNALLY-MANAGED
Expand Down
10 changes: 8 additions & 2 deletions services/data-manager/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,14 +93,20 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
# Require at least Expat's 2.5.0-1+deb12u4 security update; Debian may replace
# older revisions in its repositories. libpcre2-8-0 fixes CVE-2026-86145,
# CVE-2026-89157 and CVE-2026-89161. libbrotli1 1.0.9-2+deb12u1 fixes
# CVE-2026-111497.
# CVE-2026-111497. libssl3 and openssl 3.0.22-1~deb12u2 fix CVE-2026-84782;
# curl, git, Python and ca-certificates pull them in, and a release build can
# restore this layer from the registry build cache with the versions it held
# then. Raising a version check here changes the instruction, so that layer is
# not reused.
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
osmium-tool curl unzip bzip2 lbzip2 ca-certificates age \
git python3 python3-pip python3-venv wget rsync openssh-client \
libexpat1 libpcre2-8-0 libbrotli1 \
libexpat1 libpcre2-8-0 libbrotli1 libssl3 openssl \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge '2.5.0-1+deb12u4' \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge '1.0.9-2+deb12u1' \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge '3.0.22-1~deb12u2' \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge '3.0.22-1~deb12u2' \
&& rm -rf /var/lib/apt/lists/*

ARG DUCKDB_VERSION=1.5.6
Expand Down
12 changes: 8 additions & 4 deletions services/motis/tools/transitous/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,18 @@ ARG MOTIS_SHA256_ARM64=eda48ad1744e7be9bdd1cb515e7229e9c7ecdc3cf82c6621a64670505
# available inside the RUN below.
ARG TARGETARCH

# Explicitly upgrade PCRE2, Expat and Brotli inherited from the pinned base to
# their security fixes. The version checks fail a stale mirror and, when raised,
# invalidate this layer in the registry build cache.
# Explicitly upgrade PCRE2, Expat and Brotli inherited from the pinned base,
# and libssl3 and openssl (3.0.22-1~deb12u2 fixes CVE-2026-84782) that curl,
# git, Python and ca-certificates pull in, to their security fixes. The version
# checks fail a stale mirror and, when raised, invalidate this layer in the
# registry build cache.
RUN apt-get update -y \
&& apt-get install -y --no-install-recommends \
git python3-pip python3-venv curl wget bzip2 rsync openssh-client ca-certificates age libpcre2-8-0 libexpat1 libbrotli1 \
git python3-pip python3-venv curl wget bzip2 rsync openssh-client ca-certificates age libpcre2-8-0 libexpat1 libbrotli1 libssl3 openssl \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libexpat1)" ge 2.5.0-1+deb12u5 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libbrotli1)" ge 1.0.9-2+deb12u1 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libssl3)" ge 3.0.22-1~deb12u2 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' openssl)" ge 3.0.22-1~deb12u2 \
&& apt-get clean -y \
&& rm -rf /var/lib/apt/lists/* \
&& rm -f /usr/lib/python3.*/EXTERNALLY-MANAGED
Expand Down
Loading