fix(security): tomcat 10.1.59 + openssl 3.5.8-r0 + nanoid 3.3.18 (unblocks nightly + CI) - #123
Merged
Conversation
Nightly Trivy scan has been failing since 2026-09-03 on three CRITICAL auth-bypass CVEs in org.apache.tomcat.embed:tomcat-embed-core 10.1.55: CVE-2026-68525 FORM authentication bypass -> unauthorized resource access CVE-2026-65905 DIGEST authenticator replay -> authentication bypass CVE-2026-65182 security constraint bypass (improper access control) tomcat-embed-core is transitive-only (Spring Boot BOM -> starter-tomcat), so Dependabot's direct-only security update could not patch it and failed with security_update_dependency_not_found. Spring Boot 3.5.16 is already the latest 3.5.x and still pins 10.1.55, so a BOM property override is the fix -- same pattern as the existing jackson/logback/postgresql overrides. The advisories name 10.1.58 as the fixed version, but that release was never published to Maven Central (404); 10.1.59 is the first available release carrying the fixes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…26-14456) The backend-docker Trivy gate blocks on CVE-2026-14456 (HIGH) in openssl and libssl3 3.5.7-r0, shipped by the eclipse-temurin Alpine base layer. Alpine already ships the patched 3.5.8-r0, so extend the existing `apk upgrade` line rather than chasing a new base-image digest. Verified by building the image locally: before: openssl-3.5.7-r0 / libssl3-3.5.7-r0 after: openssl-3.5.8-r0 / libssl3-3.5.8-r0 Pre-existing failure, not introduced by the tomcat bump — backend-docker was already red on PRs #118 and #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The frontend npm-audit gate blocks on GHSA-2v37-7h3g-55p8 (high): custom generators can loop indefinitely when size is zero. nanoid is a dev-only transitive of postcss (`^3.3.12`), so the 3.3.18 patch fits the existing range — no postcss major bump needed. `node .github/scripts/audit-gate.mjs` passes locally and `npm run build` is green. Also normalises a pre-existing drift: package-lock.json still carried project version 1.0.13 while package.json is at 1.0.15 (the v1.0.15 release bumped package.json only). package.json itself is untouched. Pre-existing failure, not introduced by the tomcat bump — frontend-build was already red on PR #120. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…GH CVEs) The frontend-docker Trivy gate blocks on nine HIGH CVEs in the nginx Alpine base layer: libuuid 2.42.1-r0 -> 2.42.3-r1 CVE-2026-78408/78409/78410, -76642, CVE-2026-53612/53613/53614 libssl3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456 libcrypto3 3.5.7-r0 -> 3.5.8-r0 CVE-2026-14456CVE-2026-14456 is the same openssl flaw already patched in backend/Dockerfile; Alpine names the packages differently in the nginx image (libcrypto3 rather than openssl). Extends the existing `apk upgrade` line, consistent with the libexpat / c-ares / curl entries already there. This gate was previously masked: frontend-docker depends on frontend-build, which was failing on the nanoid advisory, so the job was skipped rather than run. It was already red on PR #118. Verified by running the exact apk upgrade line against the pinned base image digest — all targets reached (libuuid resolves to 2.42.3-r1, newer than the 2.42.3-r0 named in the advisories). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
WolfTasks pushed a commit
that referenced
this pull request
Sep 6, 2026
Ships the security fixes from PR #123: - tomcat-embed 10.1.55 -> 10.1.59 (CVE-2026-68525 / -65905 / -65182, all CRITICAL auth bypasses) - backend image: openssl/libssl3 -> 3.5.8-r0 (CVE-2026-14456) - frontend image: libssl3/libcrypto3 -> 3.5.8-r0, libuuid -> 2.42.3-r1 (9 HIGH CVEs) - nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8) Bumps package-lock.json alongside package.json; bumping package.json alone is what left the lockfile stranded at 1.0.13 through the v1.0.14 and v1.0.15 releases. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Der Nightly Security Scan schlägt seit dem 2026-09-03 fehl (grün am 02.09., rot am 03./04./05.09.). Job
trivy-repo-scan, Step "Trivy filesystem scan (gate HIGH,CRITICAL)".Ursache sind drei CRITICAL Auth-Bypass-CVEs in
org.apache.tomcat.embed:tomcat-embed-core:10.1.55, alle am 03.09. offengelegt — also genau der Fall, für den die nächtliche Kadenz gebaut wurde: neue CVEs gegen unveränderte Dependencies.Beim Verifizieren kamen zwei weitere, bereits vorher rote Gates ans Licht (belegt auf PR #118 vom 01.09. und PR #120 vom 03.09., beide main-basiert). Da sie den Merge blockieren, sind sie hier mitgefixt.
Commit 1 — tomcat 10.1.55 → 10.1.59
tomcat-embed-coreist rein transitiv (Spring Boot BOM →spring-boot-starter-tomcat). Dependabots Security-Update ist direct-only und scheiterte mitsecurity_update_dependency_not_found(Run 33745231719) — dasselbe Muster wie seinerzeit bei jackson-databind.Fix ist ein BOM-Property-Override, konsistent mit den bestehenden für
commons-lang3,jackson-bom,logbackundpostgresql:Zwei Details, die die naheliegende Lösung sonst kaputtgemacht hätten:
Bewusst kein
.trivyignore-Eintrag: das sind echte, ausnutzbare Auth-Bypässe in einem aktiv genutzten Pfad (Spring Security über Embedded Tomcat), anders als beim RSC-only react-router-CVE.Commit 2 — openssl/libssl3 3.5.7-r0 → 3.5.8-r0 (
backend-docker)Der Trivy-Image-Gate blockte auf CVE-2026-14456 (HIGH) in der Alpine-Schicht des
eclipse-temurin-Basisimages. Alpine liefert 3.5.8-r0 bereits aus, daher die bestehendeapk upgrade-Zeile erweitert statt einem neuen Basis-Digest hinterherzujagen.Commit 3 — nanoid 3.3.16 → 3.3.18 (
frontend-build)Der npm-audit-Gate blockte auf GHSA-2v37-7h3g-55p8 (high). nanoid ist dev-only transitiv über
postcss(^3.3.12), der 3.3.18-Patch passt in die bestehende Range — kein postcss-Major nötig.Nebeneffekt:
package-lock.jsontrug noch Projektversion 1.0.13, währendpackage.jsonauf 1.0.15 steht (der v1.0.15-Release hat nurpackage.jsongebumpt). npm hat das normalisiert;package.jsonselbst ist unangetastet.Verifikation (lokal)
tomcat-embed-{core,el,websocket}-10.1.59.jarbackend/gradle.lockfile: nur core/el/websocket bewegt, sonst nichtsopenssl-3.5.7-r0→openssl-3.5.8-r0,libssl3analognode .github/scripts/audit-gate.mjsgrün,npm run buildgrünNach dem Merge lohnt ein
workflow_dispatchauf den Nightly. Die Alerts #172/#173/#174 schließen sich beim nächsten Scan von selbst.🤖 Generated with Claude Code