[202505] fix: security vulnerability docker-ptf (#27059)

dockers/docker-ptf/Dockerfile.j2

@@ -295,7 +295,6 @@ RUN pip3 install Flask \
     && pip3 install pyro4 rpyc \
     && pip3 install unittest-xml-reporting \
     && pip3 install python-libpcap \
-    && pip3 install enum34 \
     && pip3 install grpcio \
     && pip3 install protobuf \
     && pip3 install six==1.16.0 \
@@ -320,7 +319,8 @@ ENV PATH="$BACKUP_OF_PATH"
 # Ensure setuptools stays in a secure range while retaining pkg_resources
 # required by grpc_tools.protoc. setuptools >=78.1.1 restores pkg_resources
 # compatibility removed in 78.0 and fixes CVE-2025-47273.
-RUN pip3 install "setuptools>=78.1.1" "wheel>=0.46.2"
+# Upgrade lxml to address GHSA-vfmq-68hx-4jfw
+RUN pip3 install "setuptools>=78.1.1" "wheel>=0.46.2" "lxml>=5.3.2"
 
 ## Adjust sshd settings
 RUN mkdir /var/run/sshd \
@@ -371,42 +371,7 @@ RUN cd gnxi \
 # Deactivating a virtualenv.
 # ENV PATH="$BACKUP_OF_PATH"
 
-# Build gnoic from source with patched Go and golang.org/x/* deps
-# upgraded to latest to address current and future golang.org/x/* CVEs.
-RUN git clone https://github.com/karimra/gnoic.git \
-    && cd gnoic \
-    && git checkout 27bc5a6 \
-    && go get google.golang.org/grpc@v1.79.3 \
-    && go get github.com/go-viper/mapstructure/v2@v2.4.0 \
-    && go get github.com/go-jose/go-jose/v4@latest \
-    && go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
-    && go mod tidy \
-    && go build -o /usr/local/bin/gnoic . \
-    && cd .. \
-    && rm -rf gnoic /root/go/pkg/mod /root/.cache/go-build
 
-# Build gnmic from source with upgraded deps to address known CVEs
-COPY gocloud-patches/ /tmp/gocloud-patches/
-RUN GNMIC_VERSION=v0.43.0 \
-    && git clone --depth 1 --branch "${GNMIC_VERSION}" https://github.com/openconfig/gnmic.git /tmp/gnmic \
-    && cd /tmp/gnmic \
-    && go get google.golang.org/grpc@v1.79.3 \
-    && go get github.com/cloudflare/circl@v1.6.3 \
-    && go get github.com/go-git/go-git/v5@latest \
-    && go get github.com/nats-io/nats-server/v2@latest \
-    && go get go.opentelemetry.io/otel/sdk@latest \
-    && go get github.com/docker/docker@latest \
-    && go get github.com/go-jose/go-jose/v4@latest \
-    && go get github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@latest github.com/aws/aws-sdk-go-v2/service/s3@latest github.com/aws/aws-sdk-go-v2/feature/s3/manager@latest \
-    && go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest \
-    && go get gocloud.dev@v0.25.1-0.20220408200107-09b10f7359f7 \
-    && go mod tidy \
-    && GOCLOUD_DIR="$(go list -m -f '{{ '{{' }}.Dir{{ '}}' }}' gocloud.dev)" \
-    && chmod -R +w "$GOCLOUD_DIR" \
-    && patch --forward -d "$GOCLOUD_DIR" -p1 < /tmp/gocloud-patches/0001-fix-aws-sdk-go-v2-pointer-api-changes.patch \
-    && go build -o /usr/local/bin/gnmic . \
-    && chmod +x /usr/local/bin/gnmic \
-    && rm -rf /tmp/gnmic /tmp/gocloud-patches /root/go/pkg/mod /root/.cache/go-build
 COPY \
 {% for deb in docker_ptf_debs.split(' ') -%}
 debs/{{ deb }}{{' '}}
@@ -457,6 +422,15 @@ RUN echo "/root/env-python3/lib/python3.9/site-packages" > /usr/lib/python3/dist
 
 RUN echo "PYTHONPATH=/root/env-python3/lib/python3.9/site-packages" >> /etc/environment
 
+# Final system-level security upgrade: ensure every Debian package is at its
+# latest patched version. This must run AFTER all apt-get install / dpkg -i
+# steps so nothing slips through.
+# Covers OpenSSL, openssh, libpng, gdk-pixbuf, inetutils, tiff CVEs.
+RUN apt-get update \
+    && apt-get upgrade -y \
+    && apt-get dist-upgrade -y \
+    && rm -rf /var/lib/apt/lists/*
+
 COPY ["*.ini", "/etc/ptf/"]
 EXPOSE 22 8009