From 86e455ab1110b02f956617af812ccd141364d82c Mon Sep 17 00:00:00 2001 From: sophia chen Date: Mon, 4 May 2026 11:40:04 +1000 Subject: [PATCH 1/3] fix(CVE-2026-33845): upgrade gnutls to 3.8.13-r0+ in Alpine base image Adds RUN apk upgrade --no-cache gnutls to patch CVE-2026-33845 (GnuTLS DoS via DTLS zero-length record, HIGH severity). UID2-7008 --- Dockerfile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Dockerfile b/Dockerfile index a77c545..fcb00d1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,9 @@ # sha from https://hub.docker.com/layers/library/eclipse-temurin/21-jre-alpine-3.23/images/sha256-693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 FROM eclipse-temurin@sha256:693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 +# CVE-2026-33845: upgrade gnutls to 3.8.13-r0+ +RUN apk upgrade --no-cache gnutls + WORKDIR /app EXPOSE 8088 From c1b9e02a834453f9ce473806acdf6090bcc1f792 Mon Sep 17 00:00:00 2001 From: sophia chen Date: Mon, 4 May 2026 13:28:58 +1000 Subject: [PATCH 2/3] fix: pin gnutls=3.8.13-r0 instead of open-ended upgrade Co-Authored-By: Claude Sonnet 4.6 --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index fcb00d1..738c6f2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,8 @@ # sha from https://hub.docker.com/layers/library/eclipse-temurin/21-jre-alpine-3.23/images/sha256-693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 FROM eclipse-temurin@sha256:693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 -# CVE-2026-33845: upgrade gnutls to 3.8.13-r0+ -RUN apk upgrade --no-cache gnutls +# CVE-2026-33845: pin gnutls to 3.8.13-r0 (fixes DoS via DTLS zero-length record) +RUN apk add --no-cache 'gnutls=3.8.13-r0' WORKDIR /app EXPOSE 8088 From 30599f9fcf29be3f1b112a8bd783ec886ff00659 Mon Sep 17 00:00:00 2001 From: sophia chen Date: Mon, 4 May 2026 13:39:04 +1000 Subject: [PATCH 3/3] fix: suppress CVE-2026-33845 in trivyignore; gnutls not used by service Co-Authored-By: Claude Sonnet 4.6 --- .trivyignore | 3 +++ Dockerfile | 3 --- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.trivyignore b/.trivyignore index 09d0486..a50cac2 100644 --- a/.trivyignore +++ b/.trivyignore @@ -5,6 +5,9 @@ # gnutls DoS vulnerability via crafted ClientHello - not impactful as gnutls is not used by our Java service # See: UID2-6655 CVE-2026-1584 exp:2026-08-27 +# gnutls DoS vulnerability via DTLS zero-length record - not impactful as gnutls is not used by our Java service +# See: UID2-7008 +CVE-2026-33845 exp:2026-11-04 # jackson-core async parser DoS - not exploitable, services only use synchronous ObjectMapper API # See: UID2-6670 diff --git a/Dockerfile b/Dockerfile index 738c6f2..a77c545 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,6 @@ # sha from https://hub.docker.com/layers/library/eclipse-temurin/21-jre-alpine-3.23/images/sha256-693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 FROM eclipse-temurin@sha256:693c22ea458d62395bac47a2da405d0d18c77b205211ceec4846a550a37684b6 -# CVE-2026-33845: pin gnutls to 3.8.13-r0 (fixes DoS via DTLS zero-length record) -RUN apk add --no-cache 'gnutls=3.8.13-r0' - WORKDIR /app EXPOSE 8088