Bump base image to clear two HIGH micrometer CVEs - #16
Merged
Conversation
Trivy flagged io.micrometer:micrometer-core 1.16.5 in the image: CVE-2026-40983 gRPC denial of service CVSS 7.5 CVE-2026-40984 HTTP denial of service CVSS 7.5 The jar is not something this repo installs. It lives at usr/share/mc-image-helper-1.64.0/lib/ inside itzg's base image, so the only lever here is the pinned digest. Not exploitable in this deployment, and worth saying why rather than treating a HIGH badge as self-explanatory. Both CVEs require an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint. mc-image-helper is a command-line tool that resolves and downloads mods at container start and then exits. It serves neither protocol and never listens on a port. There is no path to it from the network. Bumped regardless, because it costs nothing and an alert list full of findings nobody intends to act on is how a real one gets missed. Digest moves from ...4b6a75fd (built 2026-08-01) to ...2b9f121b (built 2026-08-08), which carries mc-image-helper 1.66.0 in place of 1.64.0. Deliberately NOT claiming this fixes it. micrometer is transitive in mc-image-helper and pinned by no build file in that repo, so the resolved version could not be confirmed by inspection. The Trivy scan on this commit is the verification. If the CVEs still appear against micrometer-core after this merges, the bump did not carry the fix, and the next step is asking itzg upstream rather than re-pinning blindly. Everything else in the Dockerfile is untouched: the sqlite-jdbc checksum gate and USER 1000:1000 both stand.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two open Trivy alerts.
The findings
Both against
io.micrometer:micrometer-core1.16.5, fixed in 1.16.6 / 1.15.12.Where it comes from
usr/share/mc-image-helper-1.64.0/lib/micrometer-core-1.16.5.jarNot a dependency this repo installs. It is inside itzg base image, so the only lever is the pinned digest.
Why it is not exploitable here
Worth stating rather than treating a HIGH badge as self-explanatory. Both CVEs need an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint.
mc-image-helperis a command-line tool that resolves and downloads mods at container start, then exits. It serves no gRPC, serves no HTTP, and never listens on a port. TheAV:Nattack vector these CVEs require does not exist in this deployment.Bumping anyway, because it costs nothing and an alert list full of findings nobody intends to act on is exactly how a real one gets missed later.
The change
One line. Digest moves from
...4b6a75fd(built 2026-08-01) to...2b9f121b(built 2026-08-08), which carries mc-image-helper 1.66.0 instead of 1.64.0.Untouched: the sqlite-jdbc checksum gate,
USER 1000:1000, and every mod pin.What I am deliberately NOT claiming
I have not verified this fixes it. micrometer is a transitive dependency of mc-image-helper and is pinned by no build file in that repo, so the resolved version cannot be confirmed by inspection, and the local Docker daemon is down so the image cannot be pulled and checked either.
The Trivy scan on this commit is the verification. If the two CVEs still appear against micrometer-core after this merges, the bump did not carry the fix, and the correct next step is raising it with itzg upstream rather than re-pinning blindly and hoping.
Heads up on timing
This rebuilds the image, so the droplet will restart the server when it pulls. Combined with the When Dungeons Arise merge, that is two restarts. Worth merging when nobody is mid-session.