fix(CI-24677): bump docker dind 28.1.1 to 29.8.0 and cosign v2.5.3 to v2.6.5 - #525
Draft
vinayakharness2026 wants to merge 1 commit into
Draft
Conversation
… v2.6.5 Remediates vulnerabilities in harnesssecure/ecr by updating the plugins/docker base image. ECR inherits the fix via FROM plugins/docker. Changes: - docker/docker/Dockerfile.linux.amd64: docker:28.1.1-dind -> docker:29.8.0-dind - docker/docker/Dockerfile.linux.arm64: arm64v8/docker:28.1.1-dind -> arm64v8/docker:29.8.0-dind - cosign: v2.5.3 -> v2.6.5 (fixes crypto/grpc CVEs in cosign binary) - .harness/harness.yaml: golang:1.26.5 -> golang:1.26.8 (fixes stdlib CVEs in drone-ecr binary) OnDemand Prisma Cloud scan delta (plugins/ecr:21.3.4 -> test 21.3.5): Critical: 6 -> 0 High: 46 -> 7 Medium: 43 -> 25 Total: 102 -> 32 Trivy local scan delta: Critical: 21 -> 1 High: 390 -> 37 Medium: 405 -> 8 Low: 57 -> 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/ecr
Team: ci (Harness CI Platform)
Tickets: CI-24677
Test image:
vinayakharness/ecr-test:ecr-21.3.5--debugOnDemand scanner runs (Harness https://harness0.harness.io/):
Summary
All 6 Critical CVEs are resolved (OnDemand/Prisma Cloud scanner: 6 → 0 Critical, 46 → 7 High). The fixes come from three changes: bumping the Docker-in-Docker base from
docker:28.1.1-dindtodocker:29.8.0-dind(Alpine 3.24.1), upgrading cosign fromv2.5.3tov2.6.5, and bumping the Go builder fromgolang:1.26.5togolang:1.26.8to eliminate stdlib CVEs in thedrone-ecrbinary. The remaining 7 HIGH issues are in bundled binaries shipped by docker:29.8.0-dind (containerd, runc) whose upstream transitive deps have not yet been updated; these are blocked pending upstream. QA note: docker:29.8.0 is a major version bump from 28.x — deploy to QA and run pipeline sanity before merging.Recommendation: SHIP — both OnDemand scans completed, Critical reduced to 0, no new Critical/High introduced in the
drone-ecrbinary layer.CVE Delta — Trivy (local scan)
CVE Delta — Harness OnDemand (Prisma Cloud)
Per-Ticket CVE Status
CI-24677 — P2: Security Vulnerability Fixes - harnesssecure/ecr
Summary: The published
harnesssecure/ecr:21.3.4image inherits all vulnerabilities from its baseplugins/docker:linux-amd64which in turn is builtFROM docker:28.1.1-dind. That dind image shipped with Alpine 3.21.3 (openssl 3.3.3-r0, git 2.47.2-r0, libexpat 2.7.0-r0, zlib 1.3.1-r2) and older bundled Go binaries (containerd built with Go 1.23.8, docker-buildx with crypto v0.37.0). Bumping todocker:29.8.0-dind(Alpine 3.24.1) resolves all OS-level and most bundled binary CVEs. cosign was also upgraded from v2.5.3 to v2.6.5 to fix crypto/grpc CVEs. The golang builder was bumped to 1.26.8 to fix stdlib CVEs in the compileddrone-ecrbinary.Changes Made
docker/docker/Dockerfile.linux.amd64docker:28.1.1-dind→docker:29.8.0-dind; cosignv2.5.3→v2.6.5docker/docker/Dockerfile.linux.arm64arm64v8/docker:28.1.1-dind→arm64v8/docker:29.8.0-dind; cosignv2.5.3→v2.6.5.harness/harness.yamlgolang:1.26.5→golang:1.26.8(6 linux builder occurrences)Version selection rationale:
docker:29.8.0-dindis the minimum docker dind release that ships Alpine 3.24.1 with zlib 1.3.2-r0 (required for CVE-2026-22184). docker:28.5.2-dind uses Alpine 3.22.2 which still has zlib 1.3.1-r2 (unfixed) and libexpat 2.7.3-r0 (still < 2.7.4-r0 needed for CVE-2026-25210). docker:29.8.0-dind is the lowest 29.x release available and fixes all OS-level CVEs.cosign:v2.6.5is the latest stable 2.x release; same major series as v2.5.3 (minor bump). Fixes golang.org/x/crypto (CVE-2026-56854), google.golang.org/grpc (CVE-2026-33186), sigstore/fulcio (CVE-2025-66506), and sigstore/timestamp-authority (CVE-2025-66564).golang:1.26.8is the latest 1.26.x Go toolchain (minimum safe: 1.26.6). Bumped from 1.26.5 to fix Go stdlib CVEs (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858–56862) in the compileddrone-ecrbinary. Windows stages remain on golang:1.23.0 (no change) as they use a different builder path.Newly Introduced CVEs
These libblkid/libuuid CVEs are new in Alpine 3.24.1 (not present in Alpine 3.21.3 used by docker:28.1.1-dind). They are fixable by running
apk add --no-cache util-linux-misc>=2.42.3-r1in the docker plugin Dockerfile. Since these are lower in severity than the resolved Critical/High CVEs and are in system utilities bundled by docker:29.8.0-dind (not used directly by drone-ecr), they are deferred to a follow-up. The net CVE reduction is still substantial.