Skip to content

Fix 2.10.0 vulerabilities #159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bchen49 merged 11 commits into from
Mar 9, 2026
Merged

Fix 2.10.0 vulerabilities #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
a0aa5d3
fix issues
shawnwangnih Feb 25, 2026
cd31d67
fix issues
shawnwangnih Feb 25, 2026
7a6b117
add no cache
shawnwangnih Mar 2, 2026
4d4fd0f
update Dockerfile
shawnwangnih Mar 2, 2026
cfccc18
update pom
shawnwangnih Mar 2, 2026
dda5f2a
update jackson
shawnwangnih Mar 2, 2026
91f84d3
fix dockerfile
shawnwangnih Mar 2, 2026
d4b1e7d
update tomcat
shawnwangnih Mar 2, 2026
09926c6
update porm.xml
shawnwangnih Mar 2, 2026
df123a2
update porm.xml
shawnwangnih Mar 2, 2026
ff76f0a
fix jackson
shawnwangnih Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 31 additions & 9 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,23 +5,45 @@ WORKDIR /usr/src/app
COPY . .
RUN mvn package -DskipTests

FROM maven:3.9.9-amazoncorretto-17-al2023 AS tomcat

ENV CATALINA_HOME=/usr/local/tomcat
ENV TOMCAT_VERSION=11.0.18

RUN curl -fsSL https://archive.apache.org/dist/tomcat/tomcat-11/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz -o /tmp/tomcat.tar.gz && \
mkdir -p ${CATALINA_HOME} && \
tar -xzf /tmp/tomcat.tar.gz -C ${CATALINA_HOME} --strip-components=1 && \
rm /tmp/tomcat.tar.gz
Comment on lines +14 to +16
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tomcat is downloaded and extracted directly from a remote tarball without any integrity/authenticity verification (e.g., SHA512 and/or GPG signature check). Since this image is security-hardened elsewhere, it would be safer to verify the downloaded Tomcat artifact before extracting it to reduce supply-chain risk.

Suggested change
mkdir -p ${CATALINA_HOME} && \
tar -xzf /tmp/tomcat.tar.gz -C ${CATALINA_HOME} --strip-components=1 && \
rm /tmp/tomcat.tar.gz
curl -fsSL https://archive.apache.org/dist/tomcat/tomcat-11/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz.sha512 -o /tmp/tomcat.tar.gz.sha512 && \
cd /tmp && sha512sum -c tomcat.tar.gz.sha512 && \
mkdir -p ${CATALINA_HOME} && \
tar -xzf /tmp/tomcat.tar.gz -C ${CATALINA_HOME} --strip-components=1 && \
rm /tmp/tomcat.tar.gz /tmp/tomcat.tar.gz.sha512

Copilot uses AI. Check for mistakes.

# Production stage - Amazon Linux 2023 with Corretto 17 and Tomcat 11
FROM amazoncorretto:17-al2023 AS final
FROM amazoncorretto:17-al2023-headless AS final

ENV CATALINA_HOME=/usr/local/tomcat
ENV PATH=$CATALINA_HOME/bin:$PATH
ENV TOMCAT_VERSION=11.0.12
ENV TOMCAT_VERSION=11.0.18

# Cache bust ARG - update this date to force fresh package pulls
ARG CACHE_BUST=2026-03-02

RUN dnf update -y && \
dnf install -y unzip tar gzip shadow-utils wget && \
# Force refresh repo metadata and install fixed package versions
RUN echo "CACHE_BUST=${CACHE_BUST}" && \
dnf clean all && \
dnf makecache --refresh && \
dnf upgrade -y --refresh --best --allowerasing && \
dnf install -y --setopt=install_weak_deps=False wget && \
dnf install -y --refresh --best \
'openssl-libs >= 1:3.2.2-1.amzn2023.0.5' \
'openssl-fips-provider-latest >= 1:3.2.2-1.amzn2023.0.5' \
'curl-minimal >= 0:8.18.0' \
'libcurl-minimal >= 0:8.18.0' \
'gnupg2-minimal >= 0:2.3.7-1.amzn2023.0.7' \
'expat >= 0:2.7.4' \
'alsa-lib >= 0:1.2.15.3' 2>/dev/null || true && \
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This dnf install ... 2>/dev/null || true pattern will ignore failures to install the specified “fixed” package versions (and still proceed), which can undermine the security goal of this change. Consider splitting optional installs from required ones and letting required package/version installs fail the build if they can’t be satisfied.

Suggested change
'alsa-lib >= 0:1.2.15.3' 2>/dev/null || true && \
'alsa-lib >= 0:1.2.15.3' && \

Copilot uses AI. Check for mistakes.
rpm -qa | grep -E '^(openssl-libs|openssl-fips|curl-minimal|libcurl-minimal|gnupg2-minimal|expat|alsa-lib)' && \
dnf clean all && \
rm -rf /var/cache/dnf

# Download and install Tomcat 11
RUN curl -fsSL https://archive.apache.org/dist/tomcat/tomcat-11/v${TOMCAT_VERSION}/bin/apache-tomcat-${TOMCAT_VERSION}.tar.gz -o /tmp/tomcat.tar.gz && \
mkdir -p ${CATALINA_HOME} && \
tar -xzf /tmp/tomcat.tar.gz -C ${CATALINA_HOME} --strip-components=1 && \
rm /tmp/tomcat.tar.gz
COPY --from=tomcat /usr/local/tomcat ${CATALINA_HOME}

RUN rm -rf ${CATALINA_HOME}/webapps.dist \
${CATALINA_HOME}/webapps/ROOT \
Expand Down
15 changes: 14 additions & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,13 @@
<!-- Use dependencyManagement to enforce patched protobuf across transitive pulls -->
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment says dependencyManagement is used to enforce patched protobuf, but this block now also imports the Jackson BOM (and manages other versions). Please update the comment to reflect what the dependencyManagement section is actually enforcing so it doesn’t become misleading over time.

Suggested change
<!-- Use dependencyManagement to enforce patched protobuf across transitive pulls -->
<!-- Use dependencyManagement to enforce patched, centrally managed versions (e.g., Jackson BOM, protobuf, Log4j) across transitive dependencies -->

Copilot uses AI. Check for mistakes.
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>2.21.1</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>com.google.protobuf</groupId>
<artifactId>protobuf-java</artifactId>
Expand Down Expand Up @@ -230,7 +237,13 @@
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
<version>11.0.12</version>
<version>11.0.18</version>
</dependency>

<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.21.1</version>
Copy link

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

jackson-core is pinned with an explicit version even though this POM imports com.fasterxml.jackson:jackson-bom and later notes “Jackson (inherit version from BOM)”. Keeping a separate hard-coded version here creates a second source of truth and makes future upgrades error-prone; prefer omitting the <version> (or removing the direct dependency if it’s only meant to pull the patched version transitively) and let the BOM manage it consistently.

Suggested change
<version>2.21.1</version>

Copilot uses AI. Check for mistakes.
</dependency>

<!-- JUnit 5 -->
Expand Down