From 10b23979a7dce7b525d9dba600d77d57ced620e6 Mon Sep 17 00:00:00 2001 From: Sunny Wu Date: Wed, 25 Feb 2026 16:03:31 +1100 Subject: [PATCH 1/2] Upgrade gnutls to fix CVE-2026-1584 vulnerability Add explicit gnutls upgrade in Dockerfile to address HIGH severity vulnerability CVE-2026-1584 in gnutls 3.8.11-r0 (fixed in 3.8.12-r0) in the alpine base image. The vulnerability allows Remote Denial of Service via crafted ClientHello with invalid PSK. Jira: UID2-6655 Co-Authored-By: Claude Sonnet 4.6 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 7d99731..9527d02 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ COPY ./target/${JAR_NAME}-${JAR_VERSION}-sources.jar /app COPY ./conf/default-config.json /app/conf/ COPY ./conf/*.xml /app/conf/ -RUN apk add --no-cache --upgrade libpng && adduser -D uid2-core && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating +RUN apk add --no-cache --upgrade libpng gnutls && adduser -D uid2-core && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating USER uid2-core CMD java \ From 8b54f77a8959c758688d84bfb8469da0ede5e729 Mon Sep 17 00:00:00 2001 From: Sunny Wu Date: Fri, 27 Feb 2026 11:42:00 +1100 Subject: [PATCH 2/2] UID2-6655: Add CVE-2026-1584 to .trivyignore instead of upgrading gnutls gnutls is an OS-level library present in the alpine base image but is not used by our Java service. Upgrading it via apk introduces unnecessary risk of breaking system-level dependencies. The vulnerability (Remote DoS via crafted ClientHello) has no impact on our software. CVE-2026-1584 exp:2026-08-27 Co-Authored-By: Claude Sonnet 4.6 --- .trivyignore | 6 +++++- Dockerfile | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.trivyignore b/.trivyignore index 0a8aa9a..ab7245e 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,3 +1,7 @@ # List any vulnerability that are to be accepted -# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/ +# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/ # for more details + +# gnutls DoS vulnerability via crafted ClientHello - not impactful as gnutls is not used by our Java service +# See: UID2-6655 +CVE-2026-1584 exp:2026-08-27 diff --git a/Dockerfile b/Dockerfile index 9527d02..7d99731 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ COPY ./target/${JAR_NAME}-${JAR_VERSION}-sources.jar /app COPY ./conf/default-config.json /app/conf/ COPY ./conf/*.xml /app/conf/ -RUN apk add --no-cache --upgrade libpng gnutls && adduser -D uid2-core && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating +RUN apk add --no-cache --upgrade libpng && adduser -D uid2-core && mkdir -p /app && chmod 705 -R /app && mkdir -p /app/file-uploads && chmod 777 -R /app/file-uploads && mkdir -p /app/pod_terminating && chmod 777 -R /app/pod_terminating USER uid2-core CMD java \