fix: [CI-22510]: remediate 13 CVEs in drone-git rootless images#130
Open
vinayakharness2026 wants to merge 2 commits into
Open
fix: [CI-22510]: remediate 13 CVEs in drone-git rootless images#130vinayakharness2026 wants to merge 2 commits into
vinayakharness2026 wants to merge 2 commits into
Conversation
…rootless images Explicitly update vulnerable OS packages (openssh, nghttp2, libarchive, python3, krb5-libs) to pick up security fixes. The 5 Go stdlib CVEs in git-lfs are deferred until upstream releases a build with Go >= 1.25.9. Resolved CVEs (OS-level): - CVE-2026-25679 (go-rpm-macros) - CVE-2026-27135 (nghttp2) - CVE-2026-3497 (openssh) - CVE-2026-35385 (openssh) - CVE-2026-40356 (krb5) - CVE-2026-4424 (libarchive) - CVE-2026-4519 (python3.9) - CVE-2026-4786 (python3.9) - CVE-2026-6100 (python3.9) Deferred CVEs (Go stdlib in git-lfs, no upstream fix available): - CVE-2025-61726 (net/url) - CVE-2025-61729 (crypto/x509) - CVE-2026-25679 (net/url) - CVE-2026-32280 (crypto/x509) - CVE-2026-32283 (crypto/tls) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
vinayakharness2026
force-pushed
the
fix/vuln-remediation-CI-22510
branch
from
f2d7a43 to
8bae6b4
Compare
vinayakharness2026
changed the title
…remaining 5 Go stdlib CVEs⚠️ POTENTIALLY BREAKING: This changes how git-lfs is installed — from downloading a pre-built binary to building from source (v3.7.1) with Go 1.25.9. Same git-lfs version, but different build. Please verify git-lfs operations (clone, pull, push) thoroughly before merging. This resolves the remaining 5 Go stdlib CVEs that could not be fixed by OS package updates alone: - CVE-2025-61726 (net/url) - CVE-2025-61729 (crypto/x509) - CVE-2026-25679 (net/url) - CVE-2026-32280 (crypto/x509) - CVE-2026-32283 (crypto/tls) Also upgrades x/crypto to v0.49.0 in the git-lfs build. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
vinayakharness2026
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remediate all 13 CVEs reported in CI-22510 for
harnesssecure/drone-git:1.7.17-rootless.This PR changes how
git-lfsis installed. Previously, a pre-built binary was downloaded from the git-lfs GitHub releases. Now it is built from source (same version v3.7.1) using Go 1.25.9 to resolve Go stdlib CVEs that the pre-built binary ships with (Go 1.25.3).The git-lfs version and functionality are identical, but the binary is compiled differently. Please test git-lfs operations thoroughly (clone, pull, push with LFS objects) before merging.
Why this is necessary: upstream git-lfs v3.7.1 ships with Go 1.25.3 and no newer release exists. The 5 Go stdlib CVEs cannot be fixed without recompiling.
Changes
go.moddocker/Dockerfile.rootless.linux.amd64microdnf updatefor OS packagesdocker/Dockerfile.rootless.linux.amd64.rfdocker/Dockerfile.rootless.linux.arm64.rfScan Results (OnDemand Vulnerability Scanner)
Test image:
vinayakharness/drone-git-test:drone-git-1.7.18--debugAll 13 CVEs Resolved
OS-level packages (8 CVEs) — via
microdnf updateGo stdlib in git-lfs (5 CVEs) — via source build with Go 1.25.9
Test Plan
git lfs versionoutputs v3.7.1git lfs clone,git lfs pull,git lfs pushwith actual LFS objects🤖 Generated with Claude Code