From 382f9bec6b6bd60ad6467ea08209549c2cf11d6e Mon Sep 17 00:00:00 2001 From: curo1305 Date: Thu, 4 Jun 2026 19:13:05 +0200 Subject: [PATCH] =?UTF-8?q?fix(06-06):=20patch=20OpenSSL=20CVE-2026-31789?= =?UTF-8?q?=20=E2=80=94=20add=20apt-get=20upgrade=20to=20runtime=20Dockerf?= =?UTF-8?q?ile=20stage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Apply all available OS security updates in the runtime image stage to pull in openssl 3.5.5-1~deb13u2 (fixes CVE-2026-31789 heap buffer overflow). Three CVEs with no upstream fix (Mesa will_not_fix, perl-base affected) documented and suppressed in .trivyignore with rationale. Trivy rescan exits 0 (D-10 gate passes). Co-Authored-By: Claude Sonnet 4.6 --- .trivyignore | 27 +++++++++++++++++++++++++++ backend/Dockerfile | 10 ++++++---- 2 files changed, 33 insertions(+), 4 deletions(-) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..135d2c8 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,27 @@ +# Trivy CVE ignore file — DocuVault +# Each entry is a CVE ID that is accepted with documented rationale. +# Reviewed: 2026-06-04 + +# CVE-2026-40393 — Mesa out-of-bounds memory access (libgbm1, libgl1-mesa-dri, libglx-mesa0, mesa-libgallium) +# Status: will_not_fix (Debian) +# Rationale: Mesa GPU rendering libraries are pulled in as dependencies of libgl1 (required by +# PyMuPDF for PDF text extraction). In a headless server container, no GPU rendering is ever +# performed — the vulnerable GPU code paths are never invoked. Debian has reviewed this CVE +# and chosen not to fix it in the current release (will_not_fix). Re-evaluate when a fix +# becomes available or when libgl1 can be replaced with a GPU-stub alternative. +CVE-2026-40393 + +# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks (perl-base) +# Status: affected, no fix available +# Rationale: perl-base is a mandatory component of the python:3.12-slim base image (Debian 13). +# It cannot be removed without rebuilding the base image. No patched version exists upstream. +# The vulnerability requires an attacker to supply a crafted tar archive to perl-archive-tar; +# DocuVault never processes tar archives via perl. Re-evaluate when Debian ships a patch. +CVE-2026-42496 + +# CVE-2026-8376 — Perl heap buffer overflow when compiling (perl-base) +# Status: affected, no fix available +# Rationale: Same as CVE-2026-42496. No fix available in Debian 13. The vulnerable code path +# (Perl regex compilation) is never invoked by DocuVault's Python runtime. Re-evaluate +# when Debian ships a patch. +CVE-2026-8376 diff --git a/backend/Dockerfile b/backend/Dockerfile index 8aadd2b..0b03c27 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -13,10 +13,12 @@ RUN pip install --no-cache-dir --prefix=/install -r requirements.txt # Stage 2: runtime — lean image with only what the app needs at runtime FROM python:3.12-slim AS runtime -RUN apt-get update && apt-get install -y --no-install-recommends \ - tesseract-ocr \ - libgl1 \ - libglib2.0-0 \ +RUN apt-get update \ + && apt-get upgrade -y --no-install-recommends \ + && apt-get install -y --no-install-recommends \ + tesseract-ocr \ + libgl1 \ + libglib2.0-0 \ && rm -rf /var/lib/apt/lists/* COPY --from=builder /install /usr/local