Skip to content

fix: security vulnerability docker-ptf #27059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yejianquan merged 1 commit into from
May 1, 2026
Merged

fix: security vulnerability docker-ptf #27059

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 11 additions & 24 deletions dockers/docker-ptf/Dockerfile.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -334,7 +334,6 @@ RUN pip3 install Flask \
&& pip3 install pyro4 rpyc \
&& pip3 install unittest-xml-reporting \
&& pip3 install python-libpcap \
&& pip3 install enum34 \
&& pip3 install grpcio \
&& pip3 install six \
&& pip3 install itsdangerous \
Expand All @@ -360,7 +359,8 @@ RUN set -e; \
{% endif %}

# Ensure setuptools >= 70.0.0 to address GHSA-cx63-2mw6-8hw5
RUN pip3 install "setuptools>=70.0.0"
# Upgrade lxml to address GHSA-vfmq-68hx-4jfw
RUN pip3 install "setuptools>=70.0.0" "lxml>=5.3.2"

Copilot AI Apr 29, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Installing lxml via pip can fall back to building from source when a prebuilt wheel isn’t available for the target architecture/OS (e.g., armhf/stretch). This Dockerfile doesn’t install common build deps for lxml (libxml2-dev/libxslt1-dev/zlib1g-dev), which can make the image build fail on those targets. To keep builds reliable, either install python3-lxml from apt for Debian-based images, or add the required system build dependencies / enforce binary wheels (fail fast if unavailable).

Suggested change
RUN pip3 install "setuptools>=70.0.0" "lxml>=5.3.2"
# Install lxml build dependencies so pip fallback source builds succeed
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
libxml2-dev \
libxslt1-dev \
zlib1g-dev \
&& rm -rf /var/lib/apt/lists/* \
&& pip3 install "setuptools>=70.0.0" "lxml>=5.3.2"

Copilot uses AI. Check for mistakes.

## Adjust sshd settings
RUN mkdir /var/run/sshd \
Expand Down Expand Up @@ -411,28 +411,6 @@ RUN cd gnxi \
# Deactivating a virtualenv.
# ENV PATH="$BACKUP_OF_PATH"

# Build gnmic from source with upgraded deps to address known CVEs
COPY gocloud-patches/ /tmp/gocloud-patches/
RUN GNMIC_VERSION=v0.43.0 \

@ronan-nexthop ronan-nexthop May 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could we not just try upgrading this rather than removing a testing framework?? 0.45 is out @yejianquan

&& git clone --depth 1 --branch "${GNMIC_VERSION}" https://github.com/openconfig/gnmic.git /tmp/gnmic \
&& cd /tmp/gnmic \
&& go get google.golang.org/grpc@v1.79.3 \
&& go get github.com/cloudflare/circl@v1.6.3 \
&& go get github.com/go-git/go-git/v5@latest \
&& go get github.com/nats-io/nats-server/v2@latest \
&& go get go.opentelemetry.io/otel/sdk@latest \
&& go get github.com/docker/docker@latest \
&& go get github.com/go-jose/go-jose/v4@latest \
&& go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@latest github.com/aws/aws-sdk-go-v2/service/s3@latest github.com/aws/aws-sdk-go-v2/feature/s3/manager@latest \
&& go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
&& go get gocloud.dev@v0.25.1-0.20220408200107-09b10f7359f7 \
&& go mod tidy \
&& GOCLOUD_DIR="$(go list -m -f '{{ '{{' }}.Dir{{ '}}' }}' gocloud.dev)" \
&& chmod -R +w "$GOCLOUD_DIR" \
&& patch --forward -d "$GOCLOUD_DIR" -p1 < /tmp/gocloud-patches/0001-fix-aws-sdk-go-v2-pointer-api-changes.patch \
&& go build -o /usr/local/bin/gnmic . \
&& chmod +x /usr/local/bin/gnmic \
&& rm -rf /tmp/gnmic /tmp/gocloud-patches /root/go/pkg/mod /root/.cache/go-build

# Remove Go toolchain to reduce image size
RUN rm -rf /usr/local/go "$(go env GOPATH 2>/dev/null || echo $HOME/go)"
Expand Down Expand Up @@ -475,6 +453,15 @@ RUN echo "/root/env-python3/lib/python3.11/site-packages" > /usr/lib/python3/dis

RUN echo "PYTHONPATH=/root/env-python3/lib/python3.11/site-packages" >> /etc/environment

# Final system-level security upgrade: ensure every Debian package is at its
# latest patched version. This must run AFTER all apt-get install / dpkg -i
# steps so nothing slips through.
# Covers OpenSSL, openssh, libpng, gdk-pixbuf, inetutils, tiff CVEs.
RUN apt-get update \
&& apt-get upgrade -y \

Copilot AI Apr 29, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The final security-upgrade layer runs both apt-get upgrade -y and apt-get dist-upgrade -y back-to-back. dist-upgrade already performs upgrades, so the preceding upgrade is redundant (extra build time + another moving part). Consider dropping one of them (typically keep only upgrade unless you specifically need dist-upgrade).

Suggested change
&& apt-get upgrade -y \

Copilot uses AI. Check for mistakes.
&& apt-get dist-upgrade -y \
&& rm -rf /var/lib/apt/lists/*
Comment on lines +456 to +463

Copilot AI Apr 29, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description is currently the unfilled template (missing rationale, implementation details, and concrete verification/testing steps). Please update the PR description with at least: what vulnerability(ies) are addressed, how the changes mitigate them, and how to build/test docker-ptf to validate the fix.

Copilot uses AI. Check for mistakes.

Comment on lines +456 to +464
COPY ["*.ini", "/etc/ptf/"]
EXPOSE 22 8009

Expand Down
47 changes: 0 additions & 47 deletions dockers/docker-ptf/gocloud-patches/0001-fix-aws-sdk-go-v2-pointer-api-changes.patch
View file
Open in desktop

This file was deleted.

Loading