Skip to content

fix(security): tomcat 10.1.59 + openssl 3.5.8-r0 + nanoid 3.3.18 (unblocks nightly + CI) #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WolfTasks merged 4 commits into from
Sep 6, 2026
Merged

fix(security): tomcat 10.1.59 + openssl 3.5.8-r0 + nanoid 3.3.18 (unblocks nightly + CI) #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
62548af
fix(security): bump tomcat-embed 10.1.55 -> 10.1.59 (3 CRITICAL CVEs)
Sep 6, 2026
8682946
fix(ci): upgrade openssl/libssl3 to 3.5.8-r0 in backend image (CVE-20…
Sep 6, 2026
92fc95d
fix(ci): bump nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8)
Sep 6, 2026
4d73b90
fix(ci): upgrade libssl3/libcrypto3 + libuuid in frontend image (9 HI…
Sep 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion backend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# eclipse-temurin:21-jre-alpine
FROM eclipse-temurin:25-jre-alpine@sha256:28db6fdf60e38945e43d840c0333aeaec66c15943070104f7586fd3c9d1665b0
RUN apk upgrade --no-cache p11-kit p11-kit-trust libexpat
RUN apk upgrade --no-cache p11-kit p11-kit-trust libexpat openssl libssl3
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY build/libs/*.jar app.jar
Expand Down
9 changes: 9 additions & 0 deletions backend/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,15 @@ extra["logback.version"] = "1.5.35"
// postgresql 42.7.11 -> 42.7.12 fixes CVE-2026-54291 (HIGH). Spring Boot 3.5.16 BOM pins 42.7.11;
// override the managed property so the runtime JDBC driver picks up the patched release.
extra["postgresql.version"] = "42.7.12"
// tomcat-embed 10.1.55 -> 10.1.59 fixes three CRITICAL auth-bypass CVEs (disclosed 2026-09-03,
// caught by the nightly Trivy scan): CVE-2026-68525 (FORM authentication bypass), CVE-2026-65905
// (DIGEST authenticator replay) and CVE-2026-65182 (security constraint bypass).
// The advisories name 10.1.58 as the fix, but that release was never published to Maven Central
// (404) — 10.1.59 is the first available release carrying the fixes. Spring Boot 3.5.16 is the
// latest 3.5.x and still pins 10.1.55, and tomcat-embed-core is transitive-only here, so
// Dependabot's direct-only security update could not patch it (security_update_dependency_not_found).
// Override the shared property so core, el and websocket move together.
extra["tomcat.version"] = "10.1.59"

// Override Spring Boot BOM version for Testcontainers to support Docker Desktop 4.x on Windows
dependencyManagement {
Expand Down
6 changes: 3 additions & 3 deletions backend/gradle.lockfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,9 +73,9 @@ org.apache.commons:commons-compress:1.28.0=testCompileClasspath,testRuntimeClass
org.apache.commons:commons-lang3:3.18.0=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-api:2.24.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.logging.log4j:log4j-to-slf4j:2.24.3=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-core:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-el:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-websocket:10.1.55=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-core:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-el:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apache.tomcat.embed:tomcat-embed-websocket:10.1.59=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath
org.aspectj:aspectjweaver:1.9.25.1=compileClasspath,productionRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
org.assertj:assertj-core:3.27.7=testCompileClasspath,testRuntimeClasspath
Expand Down
4 changes: 3 additions & 1 deletion frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,9 @@ RUN npm run build
FROM nginx:alpine@sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752
# libexpat 2.8.1-r0 -> 2.8.2-r0 (CVE-2026-56131/56407/56408); c-ares 1.34.6-r0 -> 1.34.8-r0 (CVE-2026-33630)
# curl/libcurl 8.19.0-r0 -> 8.20.0-r0 (CVE-2026-5773/6276)
RUN apk upgrade --no-cache libexpat c-ares curl
# libssl3/libcrypto3 3.5.7-r0 -> 3.5.8-r0 (CVE-2026-14456, same openssl flaw patched in backend/Dockerfile)
# libuuid 2.42.1-r0 -> 2.42.3-r1 (CVE-2026-78408/78409/78410, -76642, -53612/53613/53614)
RUN apk upgrade --no-cache libexpat c-ares curl libssl3 libcrypto3 libuuid
COPY --from=builder /app/dist /usr/share/nginx/html
COPY nginx-spa.conf /etc/nginx/conf.d/default.conf
EXPOSE 80
10 changes: 5 additions & 5 deletions frontend/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading