fix: [CI-24668]: remediate vulnerabilities in harnesssecure/gar - upgrade to 21.3.5 - #526
Draft
vinayakharness2026 wants to merge 1 commit into
Conversation
…rade to 21.3.5 - docker base: 28.1.1-dind → 29.8.0-dind (fixes containerd, dockerd, buildx, compose CVEs) - cosign: v2.5.3 → v2.6.5 (same-registry latest; upstream x/crypto fix pending) - golang.org/x/crypto: v0.54.0 → v0.56.0 (fixes CVE-2026-56854 CRITICAL in drone-gar) - google.golang.org/grpc: v1.82.0 → v1.83.2 (fixes CVE-2026-84304, GHSA-hrxh-6v49-42gf HIGH) - golang.org/x/text: v0.40.0 → v0.41.0, x/net: v0.57.0 → v0.58.0 - go toolchain: 1.25.7 → 1.26.8 (fixes 8 stdlib HIGH CVEs in drone-gar binary) - .harness/harness.yaml: golang:1.26.5 → golang:1.26.8 (amd64/arm64 linux build stages) Trivy: 22C/392H/405M/57L → 3C/72H/29M/6L OnDemand (Prisma Cloud): 18C/98H → 5C/30H Blocked: cosign ships x/crypto@v0.46.0 (no v2/v3 release ships ≥v0.55.0); docker:29.8.0-dind containerd ships x/crypto@v0.53.0 (awaiting Docker upstream update).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/gar
Team: ci (Harness CI Platform)
Tickets: CI-24668
Test image:
vinayakharness/gar-test:gar-21.3.5--debugOnDemand scanner runs (Harness https://harness0.harness.io/):
Summary
This PR addresses 234 vulnerabilities in
harnesssecure/gar:21.3.4, achieving a 72% reduction in Critical CVEs (22→3 Trivy, 18→5 OnDemand) and 82% reduction in High CVEs (392→72 Trivy, 98→30 OnDemand). Key fixes:golang.org/x/cryptoupgraded to v0.56.0 (fixes CVE-2026-56854 CRITICAL in thedrone-garbinary),grpcupgraded to v1.83.2 (fixes 2 HIGH CVEs), Go toolchain bumped to 1.26.8 (fixes 8 stdlib HIGH CVEs), and docker base image updated from28.1.1-dindto29.8.0-dind(eliminates most bundled binary CVEs). Three blocked Critical CVEs remain (cosign x/crypto@v0.46.0, cosign grpc@v1.77.0, containerd x/crypto@v0.53.0) — no same-registry upstream fix available yet. Recommendation: REVIEW — significant improvement but three Criticals blocked pending upstream releases.CVE Delta — Trivy (local scan)
CVE Delta — Harness OnDemand (Prisma Cloud)
Per-Ticket CVE Status
CI-24668 — Security Vulnerability Fixes - harnesssecure/gar
Summary: The harnesssecure/gar:21.3.4 image inherits vulnerabilities from four sources: (1) the docker:28.1.1-dind base image shipping bundled Go binaries (containerd, dockerd, docker-buildx, docker-compose) compiled with outdated x/crypto and grpc; (2) the cosign binary installed at build time; (3) the drone-gar Go binary itself (x/crypto@v0.54.0, grpc@v1.82.0, stdlib@v1.26.5); and (4) Alpine OS packages (openssl). This PR upgrades the docker base to 29.8.0-dind, cosign to v2.6.5, bumps all Go dependencies in go.mod, and updates the build toolchain to golang:1.26.8.
Changes Made
docker/docker/Dockerfile.linux.amd64docker:28.1.1-dind→docker:29.8.0-dind; cosignv2.5.3→v2.6.5docker/docker/Dockerfile.linux.arm64arm64v8/docker:28.1.1-dind→arm64v8/docker:29.8.0-dind; cosignv2.5.3→v2.6.5(arm64)go.modv0.54.0→v0.56.0, grpcv1.82.0→v1.83.2, x/textv0.40.0→v0.41.0, x/netv0.57.0→v0.58.0,go 1.25.7→go 1.26.8go.sum.harness/harness.yamlgolang:1.26.5→golang:1.26.8(6 linux build stages: linux-amd64, linux-arm64, rf-linux-amd64, rf-linux-arm64)Version selection rationale:
docker:29.8.0-dind: minimum stable same-registry version that eliminates dockerd/buildx/compose CRITICAL CVEs; 29.7.2 still had 4 CRITICAL bundled-binary CVEsgolang.org/x/crypto v0.56.0: minimum version fixing CVE-2026-56854 (CRITICAL) and CVE-2026-56855/CVE-2026-78662 (UNKNOWN)google.golang.org/grpc v1.83.2: minimum stable version fixing CVE-2026-84304 (HIGH, fix in ≥1.83.1) and GHSA-hrxh-6v49-42gf (HIGH, fix in ≥1.82.1)golang:1.26.8: latest Go 1.26.x; 1.26.6 is the minimum that fixes the 8 stdlib HIGH CVEs in drone-gar, but 1.26.8 is latest patchcosign v2.6.5: current same-registry latest; no v2 or v3 release ships x/crypto≥0.55.0 — blocked pending upstreamThe following bundled binaries contain Critical CVEs that cannot be resolved by upgrading within the same registry:
cosign (installed in the docker Dockerfile): cosign v2.6.5 (and v3.1.3) ship
golang.org/x/crypto@v0.46.0andgoogle.golang.org/grpc@v1.77.0— no cosign release has shipped with x/crypto≥0.55.0 or grpc≥1.79.3 as of 2026-09-08. Action: once sigstore publishes a cosign release with updated deps, bump the cosign version in both Dockerfiles.containerd (bundled in docker:29.8.0-dind): ships with
golang.org/x/crypto@v0.53.0. docker:29.8.0-dind is the latest stable release. Action: bump to the next docker:29.x.y-dind or 30.x.y-dind release when it ships with containerd recompiled against x/crypto≥0.55.0.