From 88f5c7bc4696a4ca8016a551250876a2119be2e1 Mon Sep 17 00:00:00 2001 From: Sunny Wu Date: Wed, 25 Feb 2026 16:03:27 +1100 Subject: [PATCH 1/2] Upgrade gnutls to fix CVE-2026-1584 vulnerability Add explicit gnutls upgrade in Dockerfile to address HIGH severity vulnerability CVE-2026-1584 in gnutls 3.8.11-r0 (fixed in 3.8.12-r0) in the alpine base image. The vulnerability allows Remote Denial of Service via crafted ClientHello with invalid PSK. Jira: UID2-6655 Co-Authored-By: Claude Sonnet 4.6 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index fb4e9ad7..1de4a5b4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,7 @@ COPY ./conf/default-config.json /app/conf/ COPY ./conf/*.xml /app/conf/ COPY ./webroot/ /app/webroot/ -RUN apk add --no-cache --upgrade libpng && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads +RUN apk add --no-cache --upgrade libpng gnutls && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads USER uid2-admin CMD java \ From 3bbc9b556de206dd7e05d59ccca5e72713dcd304 Mon Sep 17 00:00:00 2001 From: Sunny Wu Date: Fri, 27 Feb 2026 11:41:59 +1100 Subject: [PATCH 2/2] UID2-6655: Add CVE-2026-1584 to .trivyignore instead of upgrading gnutls gnutls is an OS-level library present in the alpine base image but is not used by our Java service. Upgrading it via apk introduces unnecessary risk of breaking system-level dependencies. The vulnerability (Remote DoS via crafted ClientHello) has no impact on our software. CVE-2026-1584 exp:2026-08-27 Co-Authored-By: Claude Sonnet 4.6 --- .trivyignore | 4 ++++ Dockerfile | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index c863a7e4..450cada4 100644 --- a/.trivyignore +++ b/.trivyignore @@ -9,3 +9,7 @@ CVE-2022-37767 # This is a false positive CVE # See: UID2-5493 CVE-2025-1686 + +# gnutls DoS vulnerability via crafted ClientHello - not impactful as gnutls is not used by our Java service +# See: UID2-6655 +CVE-2026-1584 exp:2026-08-27 diff --git a/Dockerfile b/Dockerfile index 1de4a5b4..fb4e9ad7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,7 +17,7 @@ COPY ./conf/default-config.json /app/conf/ COPY ./conf/*.xml /app/conf/ COPY ./webroot/ /app/webroot/ -RUN apk add --no-cache --upgrade libpng gnutls && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads +RUN apk add --no-cache --upgrade libpng && adduser -D uid2-admin && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads USER uid2-admin CMD java \