From 0e87f62daee961c66f8732210222f2903eeeba8c Mon Sep 17 00:00:00 2001 From: Tim Date: Wed, 12 Aug 2026 18:38:05 -0400 Subject: [PATCH] Bump base image to clear two HIGH micrometer CVEs Trivy flagged io.micrometer:micrometer-core 1.16.5 in the image: CVE-2026-40983 gRPC denial of service CVSS 7.5 CVE-2026-40984 HTTP denial of service CVSS 7.5 The jar is not something this repo installs. It lives at usr/share/mc-image-helper-1.64.0/lib/ inside itzg's base image, so the only lever here is the pinned digest. Not exploitable in this deployment, and worth saying why rather than treating a HIGH badge as self-explanatory. Both CVEs require an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint. mc-image-helper is a command-line tool that resolves and downloads mods at container start and then exits. It serves neither protocol and never listens on a port. There is no path to it from the network. Bumped regardless, because it costs nothing and an alert list full of findings nobody intends to act on is how a real one gets missed. Digest moves from ...4b6a75fd (built 2026-08-01) to ...2b9f121b (built 2026-08-08), which carries mc-image-helper 1.66.0 in place of 1.64.0. Deliberately NOT claiming this fixes it. micrometer is transitive in mc-image-helper and pinned by no build file in that repo, so the resolved version could not be confirmed by inspection. The Trivy scan on this commit is the verification. If the CVEs still appear against micrometer-core after this merges, the bump did not carry the fix, and the next step is asking itzg upstream rather than re-pinning blindly. Everything else in the Dockerfile is untouched: the sqlite-jdbc checksum gate and USER 1000:1000 both stand. --- Dockerfile | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b077317..6db21b2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,23 @@ # docker pull itzg/minecraft-server:java21 # docker image inspect itzg/minecraft-server:java21 --format "{{index .RepoDigests 0}}" # then replace the digest below and rebuild. -FROM itzg/minecraft-server:java21@sha256:4b6a75fd5cbca70ca3580ae8c0ea67286dd99c303554bb57e95bb2bade32f428 +# Bumped 2026-08-12 (was ...4b6a75fd, built 2026-08-01) to clear two HIGH Trivy +# findings against io.micrometer:micrometer-core 1.16.5, which ships inside the +# base image's mc-image-helper and is not something this repo installs: +# CVE-2026-40983 gRPC denial of service CVSS 7.5 +# CVE-2026-40984 HTTP denial of service CVSS 7.5 +# Both need an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint. +# mc-image-helper is a CLI that resolves and downloads mods at container start +# and then exits; it serves neither protocol and is never network-reachable, so +# neither CVE is exploitable in this deployment. Bumped anyway because it is free +# and a noisy alert list hides the finding that does matter one day. +# This build carries mc-image-helper 1.66.0 (was 1.64.0). micrometer is a +# TRANSITIVE dependency there, pinned by no build file in that repo, so which +# version it resolves to could not be confirmed by inspection. The Trivy scan on +# this commit is the verification: if the two CVEs above still appear against +# micrometer-core after this merges, the bump did not carry the fix and the next +# step is asking itzg to update, not re-pinning blindly. +FROM itzg/minecraft-server:java21@sha256:2b9f121bb539dde1902a1117c2ef5dbb1dfd1283fe242fc1a7a64ba8532b719f LABEL org.opencontainers.image.source="https://github.com/OpenSource-For-Freedom/minecraft" \ org.opencontainers.image.description="EduCraft kid-safe Forge 1.20.1 server, hardened build"