Skip to content

Investigate vulnerabilities #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
afrischk wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

Investigate vulnerabilities #55

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b2d5f46
Deps: Bump golang package to 1.23 to mitigate security holes
afrischk Jul 10, 2025
51e81fc
WIP: Use build stages and exchanged gosu for su-exec
afrischk Jul 14, 2025
2f2b627
WIP: Remove backports
afrischk Jul 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 31 additions & 11 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# The image is modified to include an older version of PostgreSQL, which
# allows us to upgrade the database from the old version to the new one.
ARG POSTGRES_VERSION=17
FROM postgres:${POSTGRES_VERSION}
FROM postgres:${POSTGRES_VERSION} AS base

Check warning

Code scanning / docker scout

CVE-2025-45582

Vulnerability : CVE-2025-45582 Severity : MEDIUM Package : pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=1.34+dfsg-1.2+deb12u1 Fixed version : not fixed EPSS Score : 0.000320 EPSS Percentile : 0.072210

Check warning

Code scanning / docker scout

CVE-2025-32989

Vulnerability : CVE-2025-32989 Severity : MEDIUM Package : pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=3.7.9-2+deb12u4 Fixed version : not fixed EPSS Score : 0.000160 EPSS Percentile : 0.022390

Check warning

Code scanning / docker scout

CVE-2025-32988

Vulnerability : CVE-2025-32988 Severity : MEDIUM Package : pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=3.7.9-2+deb12u4 Fixed version : not fixed EPSS Score : 0.000400 EPSS Percentile : 0.112020

Check warning

Code scanning / docker scout

CVE-2025-32990

Vulnerability : CVE-2025-32990 Severity : MEDIUM Package : pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=3.7.9-2+deb12u4 Fixed version : not fixed EPSS Score : 0.000450 EPSS Percentile : 0.132930

Check warning

Code scanning / docker scout

CVE-2025-6395

Vulnerability : CVE-2025-6395 Severity : MEDIUM Package : pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=3.7.9-2+deb12u4 Fixed version : not fixed EPSS Score : 0.000400 EPSS Percentile : 0.112400

Check failure

Code scanning / docker scout

CVE-2025-6020

Vulnerability : CVE-2025-6020 Severity : HIGH Package : pkg:deb/debian/pam@1.5.2-6%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=1.5.2-6+deb12u1 Fixed version : not fixed EPSS Score : 0.000230 EPSS Percentile : 0.044630

Check failure

Code scanning / docker scout

CVE-2025-7424

Vulnerability : CVE-2025-7424 Severity : HIGH Package : pkg:deb/debian/libxslt@1.1.35-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=1.1.35-1+deb12u1 Fixed version : not fixed EPSS Score : 0.000150 EPSS Percentile : 0.019550

Check failure

Code scanning / docker scout

CVE-2025-7425

Vulnerability : CVE-2025-7425 Severity : HIGH Package : pkg:deb/debian/libxslt@1.1.35-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12 Affected range : >=1.1.35-1+deb12u1 Fixed version : not fixed EPSS Score : 0.000120 EPSS Percentile : 0.011360

# we need to redeclare the ARG here, otherwise it will not
# be available in the section below the FROM statement.
Expand All @@ -13,26 +13,46 @@ ARG POSTGRES_OLD_VERSION=16
ENV POSTGRES_VERSION=${POSTGRES_VERSION}
ENV POSTGRES_OLD_VERSION=${POSTGRES_OLD_VERSION}

# The old binaries will be in /usr/lib/postgresql/16/bin
ENV PGBINOLD=/usr/lib/postgresql/${POSTGRES_OLD_VERSION}/bin
ENV PGBINNEW=/usr/lib/postgresql/${POSTGRES_VERSION}/bin

# we are usually using /var/lib/postgresql/data as the data directory
# so this is why we are using it for the 'old' version instead of the
# path that is customized for the version.
ENV PGDATAOLD=/var/lib/postgresql/data
ENV PGDATANEW=/var/lib/postgresql/${POSTGRES_VERSION}/data

COPY bin/upgradeversion.sh /usr/local/bin/upgradeversion

FROM base AS install
# Enable and install old version of PostgreSQL.
RUN sed -i "s/\$/ ${POSTGRES_OLD_VERSION}/" /etc/apt/sources.list.d/pgdg.list
RUN echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends \
postgresql-${POSTGRES_OLD_VERSION} \
; \
rm -rf /var/lib/apt/lists/*
rm -rf /var/lib/apt/lists/*;

# The old binaries will be in /usr/lib/postgresql/16/bin
ENV PGBINOLD /usr/lib/postgresql/${POSTGRES_OLD_VERSION}/bin
ENV PGBINNEW /usr/lib/postgresql/${POSTGRES_VERSION}/bin
FROM install AS no-gosu

# we are usually using /var/lib/postgresql/data as the data directory
# so this is why we are using it for the 'old' version instead of the
# path that is customized for the version.
ENV PGDATAOLD /var/lib/postgresql/data
ENV PGDATANEW /var/lib/postgresql/${POSTGRES_VERSION}/data
RUN set -eux; \
rm -rf /usr/local/bin/gosu;

COPY bin/upgradeversion.sh /usr/local/bin/upgradeversion
FROM postgres:${POSTGRES_VERSION} AS su-exec

RUN set -eux; \
apt-get update; \
apt-get install -y --no-install-recommends gcc libc-dev curl ca-certificates; \
rm -rf /var/lib/apt/lists/*; \
curl -o /usr/local/bin/su-exec.c https://raw.githubusercontent.com/ncopa/su-exec/master/su-exec.c; \
gcc -Wall /usr/local/bin/su-exec.c -o /usr/local/bin/su-exec;

FROM no-gosu AS runtime

COPY --from=su-exec --chown=root:root --chmod=755 /usr/local/bin/su-exec /usr/local/bin/gosu

# We decided to use our own UID range.
# INFO: https://github.com/greenbone/automatix/blob/main/README.md
Expand Down