Update packages for CVE fix
This commit addresses multiple vulnerabilities in the stx-audit image by upgrading python packages `setuptools` and `wheel` to secure versions: - Upgraded setuptools from 52.0.0 ➝ 78.1.1 - Fixes: * CVE-2025-47273: Path traversal in PackageIndex (RCE) * CVE-2024-6345: Remote code execution via unsafe URL handling * CVE-2022-40897: ReDoS in package_index.py via crafted HTML - Upgraded wheel from 0.34.2 ➝ 0.38.1 - Fixes: * CVE-2022-40898: DoS via crafted input to wheel CLI * PRISMA-2022-0404: ReDoS via regex in wheelfile.py Changes were made in the Dockerfile to explicitly install the upgraded versions using pip: Test Plan: PASS: Dockerfile is built properly with updated packages (setuptools==78.1.1, wheel==0.38.1) to address known CVEs. PASS: Built image pushed to registry and retagged as registry.local:9001/docker.io/starlingx/stx-audit:stx.10.0-v1.0.5 PASS: audit-armada-app app deployed successfully using the updated image. PASS: Pod state verified as Running after deployment (`kubectl get pods -n kube-system -o wide | grep auditd`). PASS: Check auditd auditable events by generating a test event (e.g., `echo "#test" >> /etc/passwd`) and validating via `ausearch -k passwd_changes`. PASS: Check auditd override settings were applied confirmed using `auditctl -l`. PASS: Check audit logrotate functionality. PASS: Application lifecycle validated (upload, apply, update, remove, delete). Story: 2011405 Task: 52475 Change-Id: Ia309ff874472fe68d449f3909973fa4b74b36ab8 Signed-off-by: Rahul Roshan Kachchap <rahulroshan.kachchap@windriver.com>
This commit is contained in:
@@ -4,7 +4,11 @@ FROM ${BASE} AS stx
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
RUN apt-get -y update && \
|
||||
apt-get -y install auditd
|
||||
apt-get -y install auditd python3-pip && \
|
||||
pip3 install --upgrade pip && \
|
||||
pip3 install --no-cache-dir --upgrade \
|
||||
setuptools==78.1.1 \
|
||||
wheel==0.38.1
|
||||
|
||||
COPY startAuditd.sh .
|
||||
|
||||
|
Reference in New Issue
Block a user