From e92620c251d1502ddc8e9a0286ac0fca806f692a Mon Sep 17 00:00:00 2001 From: DoDiODev Date: Tue, 27 Oct 2026 13:53:45 +0100 Subject: [PATCH] fix(docker): upgrade OS packages in release images The base images still ship a Brotli library that is vulnerable to CVE-2026-111497 (critical, CVSS 9.2). New base tags do not fix it yet: nginx-unprivileged 1.31.7 still has libbrotli1 1.1.0-2+b7 and grafana 13.2.4 still has brotli-libs 1.2.0-r1. Upgrade the OS packages at build time in all three images: - backend: apt-get upgrade (libbrotli1 1.0.9-2+deb12u1) - config-ui: apt-get upgrade (libbrotli1 1.1.0-2+deb13u1) - grafana: apk upgrade (brotli-libs 1.2.1-r0) Closes #9258 --- backend/Dockerfile | 2 ++ config-ui/Dockerfile | 7 ++++++- grafana/Dockerfile | 4 +++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/backend/Dockerfile b/backend/Dockerfile index cd354085d74..b85a5ec8d1a 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -118,7 +118,9 @@ RUN cd /usr/local/deps/target/lib && \ FROM python:3.11-slim-bookworm as base +# apt-get upgrade picks up Debian security fixes that the base tag does not contain yet RUN apt-get update && \ + apt-get upgrade -y && \ apt-get install -y python3-dev python3-pip tar pkg-config curl libssh2-1 zlib1g libffi-dev default-libmysqlclient-dev libpq-dev tini git openssh-client corkscrew && \ apt-get clean && \ rm -fr /usr/share/doc/* \ diff --git a/config-ui/Dockerfile b/config-ui/Dockerfile index 5a017cc63f9..f5f6925297c 100644 --- a/config-ui/Dockerfile +++ b/config-ui/Dockerfile @@ -41,7 +41,12 @@ WORKDIR /usr/share/nginx/html RUN rm -rf ./* COPY --from=builder /home/node/code/dist/. ./ EXPOSE 4000 4443 -RUN apt update && apt install -y apache2-utils iproute2 +# apt-get upgrade picks up Debian security fixes that the base tag does not contain yet +RUN apt-get update && \ + apt-get upgrade -y && \ + apt-get install -y apache2-utils iproute2 && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* COPY --from=builder /home/node/code/nginx.sh /usr/bin/nginx.sh RUN chmod +x /usr/bin/nginx.sh RUN chgrp -R 0 /etc/nginx /var/log/nginx /usr/share/nginx /run && \ diff --git a/grafana/Dockerfile b/grafana/Dockerfile index 1539b5b7ad4..913b3e766dd 100644 --- a/grafana/Dockerfile +++ b/grafana/Dockerfile @@ -37,8 +37,10 @@ ENV GF_SERVER_PROTOCOL=http ENV GF_SERVER_DOMAIN=localhost:3000 ENV GF_SERVER_ROOT_URL=http://localhost:3000/grafana USER root +# apk upgrade picks up Alpine security fixes that the base tag does not contain yet # grafana-piechart-panel removed: dashboards use the core "piechart" panel type -RUN chmod +x /entrypoint.sh && \ +RUN apk upgrade --no-cache && \ + chmod +x /entrypoint.sh && \ chgrp -R 0 /etc/grafana /usr/share/grafana /var/lib/grafana && \ chmod -R g=u /etc/grafana /usr/share/grafana /var/lib/grafana USER 101