[Bug] Auth-hosting vulnerabiliity libcurl - #1884
Open
ami-descope wants to merge 1 commit into
Open
Conversation
The auth-hosting base image (ghcr.io/verity-org/caddy:2.11.4) is Alpine-based and ships curl/libcurl 8.19.0-r0, which is vulnerable. Upgrade both to the fixed 8.20.0-r0 in the production stage. Caddy is already pinned to 2.11.4, which is the latest ghcr.io/verity-org/caddy tag and the latest upstream caddyserver/caddy release — no bump needed. The prior comment claiming a distroless/no-shell base was stale — the base is Alpine with a working shell, so the apk upgrade is safe. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
🐕 Review complete — View session on Shuni Portal 🐾 |
🐕 Suggested ReviewersThe review assignment targets contributors with direct file experience, prioritizing coverage across different aspects of the Dockerfile to ensure comprehensive review of the changes.
Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best. |
![shuni-bot[bot]](https://avatars.githubusercontent.com/in/2536750?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐕 Shuni's Review
Patches curl/libcurl to 8.20.0-r0 on the Alpine-based caddy production image (CVE fix) and drops the stale distroless "no /bin/sh" comment.
No issues found — good bones! The apk pin is fine now that the base is Alpine with a shell, and the author verified the build end-to-end. Woof!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
View workflow run
Committed cleanly.
Summary
Caddy is already at the latest version — no bump needed. The base image
ghcr.io/verity-org/caddy:2.11.4is pinned to2.11.4, which I confirmed is:ghcr.io/verity-org/caddytag (available: 2.11.1–2.11.4), andcaddyserver/caddyrelease (v2.11.4).curl/libcurl patched — this fresh branch was cut from
mainwithout the earlier CVE fix, so I re-applied it:RUN apk add --no-cache --upgrade curl=8.20.0-r0 libcurl=8.20.0-r0(also dropped the stale "distroless/no-shell" comment — the base is Alpine with a working shell).
Verified end-to-end by building the
productionstage:curl-8.20.0-r0+libcurl-8.20.0-r0installed ✅v2.11.4still runs ✅Nothing else in the repo installs or versions Caddy, so the Dockerfile is the only surface. If you specifically wanted a Caddy version newer than 2.11.4, none exists yet upstream — 2.11.4 is current.
Created by Shuni 🐕