From e3deb37fbeea8a9c51c6fecf9d843564f6a88682 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Mon, 7 Sep 2026 15:46:54 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F(frontend)=20upgrade=20bas?= =?UTF-8?q?e=20image=20to=201.30.4-alpine3.24?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump the frontend base image to `1.30.4-alpine3.24`, which picks up fixes for the CVEs listed below and lets us drop the individual dependency pins that were only there to address earlier known CVEs. Address the following HIGH severity CVEs in libuuid / util-linux, reported by Trivy. Bumping to 2.41.6-r1 (bundled in the new base image) covers all of them: * CVE-2026-53612 — TOCTOU in mount post-mount ownership/mode changes. * CVE-2026-53613 — TOCTOU in mount via ancestor directory swap. * CVE-2026-53614 — SUID mount(8) nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2. * CVE-2026-76642 — failed external mount helper still runs privileged X-mount post-hooks. * CVE-2026-78408 — nsenter --join-cgroup leaks root cgroup migration authority (fixed in 2.41.6-r1). * CVE-2026-78410 — restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode escalation. --- CHANGELOG.md | 1 + docker/dinum-frontend/Dockerfile | 14 +++----------- src/frontend/Dockerfile | 14 ++------------ 3 files changed, 6 insertions(+), 23 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 47b57bbc..a021f239 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ and this project adheres to ### Changed - ⬆️(dev) pin LiveKit server to v1.13.6 +- 🔒(frontend) upgrade base image to 1.30.4-alpine3.24 ### Fixed diff --git a/docker/dinum-frontend/Dockerfile b/docker/dinum-frontend/Dockerfile index 403d347c..8b997218 100644 --- a/docker/dinum-frontend/Dockerfile +++ b/docker/dinum-frontend/Dockerfile @@ -54,19 +54,11 @@ RUN npx webpack --mode production # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production USER root - -# Security patches for known CVEs -RUN apk update && apk upgrade \ - libcrypto3>=3.5.7-r0 \ - libssl3>=3.5.7-r0 \ - musl \ - musl-utils \ - zlib>=1.3.2-r0 \ - libexpat>=2.8.4-r0 \ - && apk del curl +RUN apk del curl +USER nginx USER nginx diff --git a/src/frontend/Dockerfile b/src/frontend/Dockerfile index 8f37a892..2d35a320 100644 --- a/src/frontend/Dockerfile +++ b/src/frontend/Dockerfile @@ -42,20 +42,10 @@ ENV VITE_APP_TITLE=${VITE_APP_TITLE} RUN npm run build # ---- Front-end image ---- -FROM nginxinc/nginx-unprivileged:1.30.3-alpine3.23 AS frontend-production +FROM nginxinc/nginx-unprivileged:1.30.4-alpine3.24 AS frontend-production USER root - -# Security patches for known CVEs -RUN apk update && apk upgrade \ - libcrypto3>=3.5.7-r0 \ - libssl3>=3.5.7-r0 \ - musl \ - musl-utils \ - zlib>=1.3.2-r0 \ - libexpat>=2.8.4-r0 \ - && apk del curl - +RUN apk del curl USER nginx # Un-privileged user running the application