Conversation
Clears 6 CVEs flagged on the ui-server Docker image: Go toolchain (1.26.3): - CVE-2026-39836 (net: panic on NUL byte) - CVE-2026-33814 (net/http2: infinite loop on SETTINGS_MAX_FRAME_SIZE=0) - CVE-2026-33811 (net: double-free in LookupCNAME with cgo resolver) golang.org/x/net v0.54.0 (≥ v0.53.0): - CVE-2026-33814 at the library level curl removed from final runtime stage (kept in builder): - CVE-2026-3805 (SMB use-after-free) - CVE-2026-6276 (cookie leak via stale Host header) - CVE-2026-5773 (SMB connection reuse)
Author
|
Closing in favor of temporalio/ui#3409 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was changed
Bumps Go toolchain and dependencies. Removed
curlfrom final stage.Why?
To clear 6 CVEs flagged against the
temporalio/ui-serverDocker image. None are exploitable in Temporal deployments, but they need to be fixed to avoid vulnerability scanner noise.Go toolchain (1.26.3):
NULbyte)net/http2: infinite loop onSETTINGS_MAX_FRAME_SIZE=0)LookupCNAMEwithcgoresolver)golang.org/x/netv0.54.0 (≥ v0.53.0):curlremoved from final runtime stage (kept in builder):Warning
Customers with custom Kubernetes manifests using
exec-based probes that shell out tocurlinside theui-servercontainer would break. This is not a pattern we document, and the official helm chart uses native Kubernetes probe types. But, it's possible someone does it. These users would need to switch tohttpGet/tcpSocketprobes, or addcurlback via a custom image layer.Additionally, with Alpine 3.23, it only ships
curl8.19.0, so upgradingcurlwithin the current Alpine release was not an option. Removal was the only way to clear the findings without bumping the Alpine major version, and gives us the benefit of reducing future vulnerability scanner noise.