137 lines
3.9 KiB
Markdown
137 lines
3.9 KiB
Markdown
# Quick Action: Rebuild Image to Apply Security Fixes
|
|
|
|
**Date**: 2026-01-11
|
|
**Severity**: LOW (Fixes already in code)
|
|
**Estimated Time**: 5 minutes
|
|
|
|
## TL;DR
|
|
|
|
✅ **Good News**: The Dockerfile ALREADY contains all security fixes!
|
|
⚠️ **Action Needed**: Rebuild Docker image to apply the fixes
|
|
|
|
CI scan detected vulnerabilities in a **stale Docker image** built before security patches were committed. Current Dockerfile uses Go 1.25.5, CrowdSec v1.7.4, and patched dependencies.
|
|
|
|
## What's Wrong?
|
|
|
|
The Docker image being scanned by CI was built **before** these fixes were added to the Dockerfile (scan date: 2025-12-18, 3 weeks old):
|
|
|
|
1. **Old Image**: Built with Go 1.25.1 (vulnerable)
|
|
2. **Current Dockerfile**: Uses Go 1.25.5 (patched)
|
|
|
|
## What's Already Fixed in Dockerfile?
|
|
|
|
```dockerfile
|
|
# Line 203: Go 1.25.5 (includes CVE fixes)
|
|
FROM --platform=$BUILDPLATFORM golang:1.25.5-alpine AS crowdsec-builder
|
|
|
|
# Line 213: CrowdSec v1.7.4
|
|
ARG CROWDSEC_VERSION=1.7.4
|
|
|
|
# Lines 227-230: Patched expr-lang/expr (CVE-2025-68156)
|
|
RUN go get github.com/expr-lang/expr@v1.17.7 && \
|
|
go mod tidy
|
|
```
|
|
|
|
**All CVEs are fixed:**
|
|
|
|
- ✅ CVE-2025-58183 (archive/tar) - Fixed in Go 1.25.2+
|
|
- ✅ CVE-2025-58186 (net/http) - Fixed in Go 1.25.2+
|
|
- ✅ CVE-2025-58187 (crypto/x509) - Fixed in Go 1.25.3+
|
|
- ✅ CVE-2025-61729 (crypto/x509) - Fixed in Go 1.25.5+
|
|
- ✅ CVE-2025-68156 (expr-lang) - Fixed with v1.17.7
|
|
|
|
## Quick Fix (5 minutes)
|
|
|
|
### 1. Rebuild Image with Current Dockerfile
|
|
|
|
```bash
|
|
# Clean old image
|
|
docker rmi charon:local 2>/dev/null || true
|
|
|
|
# Rebuild with latest Dockerfile (no changes needed!)
|
|
docker build -t charon:local .
|
|
```
|
|
|
|
### 2. Verify Fix
|
|
|
|
```bash
|
|
# Check CrowdSec version and Go version
|
|
docker run --rm charon:local /usr/local/bin/crowdsec version
|
|
|
|
# Expected output should include:
|
|
# version: v1.7.4
|
|
# Go: go1.25.5 (or higher)
|
|
```
|
|
|
|
### 3. Run Security Scan
|
|
|
|
```bash
|
|
# Install scanning tools if not present
|
|
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
|
|
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
# Scan rebuilt image
|
|
syft charon:local -o cyclonedx-json > sbom-check.json
|
|
grype sbom:./sbom-check.json --severity HIGH,CRITICAL --output table
|
|
|
|
# Expected: 0 HIGH/CRITICAL vulnerabilities in all binaries
|
|
```
|
|
|
|
### 4. Push to Registry (if needed)
|
|
|
|
```bash
|
|
# Tag and push updated image
|
|
docker tag charon:local ghcr.io/wikid82/charon:latest
|
|
docker push ghcr.io/wikid82/charon:latest
|
|
|
|
# Or trigger CI rebuild by pushing to main
|
|
git commit --allow-empty -m "chore: trigger image rebuild with security patches"
|
|
git push
|
|
```
|
|
|
|
## Expected Outcome
|
|
|
|
✅ CI supply chain scan will pass
|
|
✅ 0 HIGH/CRITICAL vulnerabilities in all binaries
|
|
✅ CrowdSec v1.7.4 with Go 1.25.5
|
|
✅ All stdlib CVEs resolved
|
|
|
|
## Why This Happened
|
|
|
|
1. **Dockerfile was updated** with security fixes (Go 1.25.5, CrowdSec v1.7.4, patched expr-lang)
|
|
2. **Docker image was NOT rebuilt** after Dockerfile changes
|
|
3. **CI scan analyzed old image** built before fixes
|
|
4. **Local scans** (`govulncheck`) don't detect binary vulnerabilities
|
|
|
|
**Solution**: Simply rebuild the image to apply fixes already in the Dockerfile.
|
|
|
|
## If You Need to Rollback
|
|
|
|
```bash
|
|
# Revert Dockerfile
|
|
git revert HEAD
|
|
|
|
# Rebuild
|
|
docker build -t charon:local .
|
|
```
|
|
|
|
## Need More Details?
|
|
|
|
See full analysis:
|
|
|
|
- [Supply Chain Scan Analysis](./SUPPLY_CHAIN_SCAN_ANALYSIS.md)
|
|
- [Detailed Remediation Plan](./SUPPLY_CHAIN_REMEDIATION_PLAN.md)
|
|
|
|
## Questions?
|
|
|
|
- **"Is our code vulnerable?"** No, only CrowdSec binary needs update
|
|
- **"Can we deploy current build?"** Yes for dev/staging, upgrade recommended for production
|
|
- **"Will this break anything?"** No, v1.6.6 is a patch release (minor Go stdlib fixes)
|
|
- **"How urgent is this?"** MEDIUM - Schedule for next release, not emergency hotfix
|
|
|
|
---
|
|
|
|
**Action Owner**: Dev Team
|
|
**Review Required**: Security Team
|
|
**Target**: Next deployment window
|