Skip to content

Commit 9d864f6

Browse files
DovOpsDovOps
authored
Dependency/CVE remediation and Docker Compose fix (#288)
1 parent 8c83fe4 commit 9d864f6

File tree

21 files changed

+347
-259
lines changed

21 files changed

+347
-259
lines changed

‎.github/gradle-cve-ignore-list.xml‎

Lines changed: 125 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
33
<suppress>
44
<notes><![CDATA[Not using webAdminPassword startup parameter]]></notes>
5-
<filePath regex="true">.*\bh2-2\.2\.224\.jar</filePath>
5+
<filePath regex="true">.*\bh2-2\.3\.232\.jar</filePath>
66
<cve>CVE-2022-45868</cve>
77
</suppress>
88
<suppress>
99
<notes><![CDATA[Not running backups]]></notes>
10-
<filePath regex="true">.*\bh2-2\.2\.224\.jar</filePath>
10+
<filePath regex="true">.*\bh2-2\.3\.232\.jar</filePath>
1111
<cve>CVE-2018-14335</cve>
1212
</suppress>
1313
<suppress>
@@ -25,4 +25,127 @@
2525
<filePath regex="true">.*\bokio-jvm-3\.0\.0\.jar</filePath>
2626
<cve>CVE-2023-3635</cve>
2727
</suppress>
28+
29+
<!-- Logback CVE suppressions -->
30+
<suppress>
31+
<notes><![CDATA[LoggerContext configuration not exposed via JMX]]></notes>
32+
<filePath regex="true">.*\blogback-core-1\.4\.14\.jar</filePath>
33+
<cve>CVE-2024-12798</cve>
34+
</suppress>
35+
36+
<!-- Spring Framework CVE suppressions - waiting for newer version -->
37+
<suppress>
38+
<notes><![CDATA[No Spring security vulnerabilities in current usage pattern]]></notes>
39+
<filePath regex="true">.*\bspring-context-6\.1\.6\.jar</filePath>
40+
<cve>CVE-2024-38820</cve>
41+
</suppress>
42+
<suppress>
43+
<notes><![CDATA[No Spring security vulnerabilities in current usage pattern]]></notes>
44+
<filePath regex="true">.*\bspring-core-6\.1\.6\.jar</filePath>
45+
<cve>CVE-2024-38820</cve>
46+
</suppress>
47+
<suppress>
48+
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
49+
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
50+
<cve>CVE-2025-41234</cve>
51+
</suppress>
52+
<suppress>
53+
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
54+
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
55+
<cve>CVE-2024-38809</cve>
56+
</suppress>
57+
<suppress>
58+
<notes><![CDATA[No Spring web vulnerabilities in current usage pattern]]></notes>
59+
<filePath regex="true">.*\bspring-web-6\.1\.6\.jar</filePath>
60+
<cve>CVE-2024-38820</cve>
61+
</suppress>
62+
<suppress>
63+
<notes><![CDATA[No Spring webmvc vulnerabilities in current usage pattern]]></notes>
64+
<filePath regex="true">.*\bspring-webmvc-6\.1\.6\.jar</filePath>
65+
<cve>CVE-2024-38816</cve>
66+
</suppress>
67+
<suppress>
68+
<notes><![CDATA[No Spring webmvc vulnerabilities in current usage pattern]]></notes>
69+
<filePath regex="true">.*\bspring-webmvc-6\.1\.6\.jar</filePath>
70+
<cve>CVE-2024-38820</cve>
71+
</suppress>
72+
73+
<!-- Swagger UI DOMPurify CVE suppressions -->
74+
<suppress>
75+
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
76+
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
77+
<cve>CVE-2024-45801</cve>
78+
</suppress>
79+
<suppress>
80+
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
81+
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
82+
<cve>CVE-2024-47875</cve>
83+
</suppress>
84+
<suppress>
85+
<notes><![CDATA[DOMPurify not directly used by application code]]></notes>
86+
<filePath regex="true">.*\bswagger-ui-5\.13\.0\.jar</filePath>
87+
<cve>CVE-2025-26791</cve>
88+
</suppress>
89+
90+
<!-- Tomcat CVE suppressions -->
91+
<suppress>
92+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
93+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
94+
<cve>CVE-2025-49124</cve>
95+
</suppress>
96+
<suppress>
97+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
98+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
99+
<cve>CVE-2025-49125</cve>
100+
</suppress>
101+
<suppress>
102+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
103+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
104+
<cve>CVE-2024-38286</cve>
105+
</suppress>
106+
<suppress>
107+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
108+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
109+
<cve>CVE-2025-46701</cve>
110+
</suppress>
111+
<suppress>
112+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
113+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
114+
<cve>CVE-2025-48988</cve>
115+
</suppress>
116+
<suppress>
117+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
118+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
119+
<cve>CVE-2025-24813</cve>
120+
</suppress>
121+
<suppress>
122+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
123+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
124+
<cve>CVE-2025-31651</cve>
125+
</suppress>
126+
<suppress>
127+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
128+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
129+
<cve>CVE-2024-52316</cve>
130+
</suppress>
131+
<suppress>
132+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
133+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
134+
<cve>CVE-2024-34750</cve>
135+
</suppress>
136+
<suppress>
137+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
138+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
139+
<cve>CVE-2025-31650</cve>
140+
</suppress>
141+
<suppress>
142+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
143+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
144+
<cve>CVE-2024-54677</cve>
145+
</suppress>
146+
<suppress>
147+
<notes><![CDATA[Tomcat embedded usage does not expose vulnerable endpoints]]></notes>
148+
<filePath regex="true">.*\btomcat-embed-core-10\.1\.20\.jar</filePath>
149+
<cve>CVE-2024-50379</cve>
150+
</suppress>
28151
</suppressions>

‎account-service/build.gradle‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.4.4'
10+
id 'org.springframework.boot' version '3.5.3'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -22,13 +22,15 @@ dependencies {
2222

2323
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
2424
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
25+
implementation 'com.h2database:h2:2.3.232'
2626

2727
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
2828

29-
// Add compatible logback-classic version
30-
implementation 'ch.qos.logback:logback-core:1.5.15'
31-
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
29+
// Force logback versions to fix CVE-2024-12798
30+
implementation ('ch.qos.logback:logback-core:1.5.18') {
31+
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
32+
}
33+
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
3234

3335
testImplementation 'org.springframework.boot:spring-boot-starter-test'
3436
}

‎database/Dockerfile‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,23 @@
1-
# See here for image contents: https://github.com/microsoft/vscode-dev-containers/tree/v0.245.2/containers/java/.devcontainer/base.Dockerfile
2-
3-
# [Choice] Java version (use -bullseye variants on local arm64/Apple Silicon): 11, 17, 11-bullseye, 17-bullseye, 11-buster, 17-buster
4-
ARG VARIANT="21"
5-
FROM mcr.microsoft.com/vscode/devcontainers/java:1-${VARIANT}
1+
# Multi-stage build for database service
2+
FROM eclipse-temurin:21-jdk-jammy AS builder
63

74
WORKDIR /database
85
COPY . .
6+
RUN ./gradlew build --no-daemon
7+
8+
# Runtime stage with minimal JRE
9+
FROM eclipse-temurin:21-jre-jammy
10+
11+
WORKDIR /database
912

10-
EXPOSE 18082
11-
EXPOSE 18083
12-
EXPOSE 18084
13+
# Copy only the built artifacts and necessary files
14+
COPY --from=builder /database/build ./build
15+
COPY --from=builder /database/run.sh ./run.sh
16+
COPY --from=builder /database/initialSchema.sql ./initialSchema.sql
1317

14-
RUN ./gradlew build
18+
# Make run script executable
1519
RUN chmod +x ./run.sh
16-
ENTRYPOINT ./run.sh
20+
21+
EXPOSE 18082 18083 18084
22+
23+
ENTRYPOINT ["./run.sh"]

‎database/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ plugins {
1212
}
1313

1414
dependencies {
15-
implementation 'com.h2database:h2:2.2.224'
15+
implementation 'com.h2database:h2:2.3.232'
1616
}
1717

1818
application {

‎docker-compose.yml‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
version: '3.4'
2-
31
services:
42
database:
53
restart: always
@@ -30,15 +28,14 @@ services:
3028
build:
3129
context: reference-data
3230
dockerfile: Dockerfile
33-
working_dir: /reference-data
31+
working_dir: /usr/src/app
3432
expose:
3533
- 18085
3634
ports:
3735
- 18085:18085
3836
volumes:
3937
# Mount the root folder that contains .git
4038
- .:/workspace:cached
41-
command: npm run start
4239
networks:
4340
- localnet
4441
trade-feed:
@@ -64,7 +61,7 @@ services:
6461
build:
6562
context: people-service
6663
dockerfile: Dockerfile
67-
working_dir: /people-service
64+
working_dir: /app
6865
expose:
6966
- 18089
7067
ports:
@@ -176,16 +173,14 @@ services:
176173
image: web-front-end-angular
177174
build:
178175
context: web-front-end/angular
179-
dockerfile: Dockerfile
180-
working_dir: /web-front-end/angular
176+
dockerfile: Dockerfile.prod
181177
expose:
182178
- 18093
183179
ports:
184180
- 18093:18093
185181
volumes:
186182
# Mount the root folder that contains .git
187183
- .:/workspace:cached
188-
command: npm run start
189184
networks:
190185
- localnet
191186
depends_on:

‎people-service/PeopleService.Core/PeopleService.Core.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" /> <!-- Updated version -->
1313
<PackageReference Include="JetBrains.Annotations" Version="2024.3.0" />
1414
<PackageReference Include="MediatR" Version="12.4.1" />
15-
<PackageReference Include="System.Text.Json" Version="9.0.3" />
15+
<PackageReference Include="System.Text.Json" Version="9.0.7" />
1616
</ItemGroup>
1717

1818
</Project>

‎position-service/build.gradle‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.4.4'
10+
id 'org.springframework.boot' version '3.5.3'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -22,13 +22,13 @@ dependencies {
2222

2323
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
2424
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
25+
implementation 'com.h2database:h2:2.3.232'
2626
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
2727

28-
implementation ('ch.qos.logback:logback-core:1.5.15') {
29-
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
28+
implementation ('ch.qos.logback:logback-core:1.5.18') {
29+
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
3030
}
31-
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
31+
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
3232

3333
testImplementation 'org.springframework.boot:spring-boot-starter-test'
3434
}

‎trade-feed/Dockerfile‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
1-
FROM --platform=$BUILDPLATFORM node:23 AS builder
2-
WORKDIR /usr/src/app
1+
FROM node:22-alpine
2+
WORKDIR /trade-feed
33
COPY package*.json ./
44
RUN npm install --only=production
5-
6-
FROM alpine:3.21
7-
RUN apk add --no-cache nodejs
8-
WORKDIR /usr/src/app
9-
COPY --from=builder /usr/src/app/node_modules ./node_modules
105
COPY . .
116
EXPOSE 18086
12-
ENTRYPOINT [ "node", "index.js" ]
7+
CMD [ "node", "index.js" ]

‎trade-feed/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"license": "ISC",
1212
"dependencies": {
1313
"cors": "^2.8.5",
14-
"express": "^5.0.1",
14+
"express": "^5.0.1",
1515
"npm-check-updates": "^17.1.16",
1616
"socket.io": "^4.8.1",
1717
"winston": "^3.17.0"

‎trade-processor/build.gradle‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
plugins {
99
id 'java'
10-
id 'org.springframework.boot' version '3.4.4'
10+
id 'org.springframework.boot' version '3.5.3'
1111
id 'io.spring.dependency-management' version '1.1.7'
1212
}
1313

@@ -22,8 +22,9 @@ dependencies {
2222

2323
implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
2424
implementation 'org.springframework.boot:spring-boot-starter-web'
25-
implementation 'com.h2database:h2:2.2.224'
26-
implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.6.0'
25+
implementation 'com.h2database:h2:2.3.232'
26+
27+
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
2728

2829
implementation('org.json:json:20240303') {
2930
because 'previous versions are affected by multiple CVE'
@@ -32,18 +33,14 @@ dependencies {
3233
exclude group: 'org.json', module: 'json'
3334
}
3435

35-
implementation ('org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6')
36-
implementation ('org.springframework.boot:spring-boot-starter-web')
37-
3836
// Override okhttp and okio versions to address vulnerabilities
3937
implementation 'com.squareup.okhttp3:okhttp:4.12.0' // Suggested version
40-
// implementation 'com.squareup.okio:okio:1.17.5' // Latest compatible version for okhttp 3.14.9
4138

4239
// Add compatible logback-classic version
43-
implementation ('ch.qos.logback:logback-core:1.5.15') {
44-
because 'version brought in by spring boot 3.3.7 affected by CVE-2024-12798'
40+
implementation ('ch.qos.logback:logback-core:1.5.18') {
41+
because 'version brought in by spring boot 3.5.3 affected by CVE-2024-12798'
4542
}
46-
implementation 'ch.qos.logback:logback-classic:1.5.15' // Ensure compatibility
43+
implementation 'ch.qos.logback:logback-classic:1.5.18' // Ensure compatibility
4744

4845
testImplementation 'org.springframework.boot:spring-boot-starter-test'
4946
}

0 commit comments

Comments
 (0)