fix(security): patch GnuTLS in consumer-prices-core base image (libgnutls30 deb12u7)#4365
Conversation
…utls30 deb12u7) The consumer-prices-core image builds on node:20-slim (Debian 12) and installs Chromium for Playwright, but the Dockerfile only ever ran `apt-get install` -- never `apt-get upgrade`. Pre-installed base-image libraries therefore stayed frozen at the tag's shipped versions, which is why Snyk flags two critical GnuTLS issues in libgnutls30: - SNYK-DEBIAN12-GNUTLS28-16344325 Improper Null Termination (CVSS 9.8) - SNYK-DEBIAN12-GNUTLS28-16344303 Integer Underflow (CVSS 9.1) Both are fixed in libgnutls30 3.7.9-2+deb12u7. `apt-get install <chromium ...>` won't pull that in because libgnutls30 is already present as a base-image transitive dependency, so apt has no reason to touch it. Add an explicit `apt-get upgrade` between update and install so the pre-installed packages pick up Debian's security point-releases. The existing tolerance for transient apt mirror failures on `apt-get update` is preserved. Co-Authored-By: Claude Opus 4.8 <[email protected]>
lspassos1
added
security
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Greptile SummaryAdds
Confidence Score: 4/5Safe to merge — the change correctly patches the flagged GnuTLS CVEs and touches no application code. The upgrade step does not carry the same download-failure tolerance ( consumer-prices-core/Dockerfile — specifically the Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["apt-get update"] -->|success| B["apt-get upgrade -y\n--no-install-recommends"]
A -->|failure swallowed by OR-true| B
B -->|success| C["apt-get install -y --fix-missing\nchromium + Playwright deps"]
B -->|failure - no resilience guard| X["Build fails"]
C -->|success| D["rm -rf /var/lib/apt/lists/*"]
C -->|missing pkg tolerated by fix-missing| D
D --> E["Layer complete\nlibgnutls30 3.7.9-2+deb12u7"]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A["apt-get update"] -->|success| B["apt-get upgrade -y\n--no-install-recommends"]
A -->|failure swallowed by OR-true| B
B -->|success| C["apt-get install -y --fix-missing\nchromium + Playwright deps"]
B -->|failure - no resilience guard| X["Build fails"]
C -->|success| D["rm -rf /var/lib/apt/lists/*"]
C -->|missing pkg tolerated by fix-missing| D
D --> E["Layer complete\nlibgnutls30 3.7.9-2+deb12u7"]
Reviews (1): Last reviewed commit: "fix(security): patch GnuTLS in consumer-..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3d21a1f7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
koala73
added
High Value
Review feedback (greptile + codex): the new `apt-get upgrade` lacked the download-failure tolerance that `apt-get update` (|| true) and `apt-get install` (--fix-missing) already had, so a transient mirror outage during the upgrade download phase would break the Railway build — a regression to the build tolerance this PR claims to preserve. Retry `apt-get update` (up to 3x) so the index refresh is reliable before the security upgrade, and give the upgrade the same `|| true` tolerance as the other network steps. Net: the upgrade no longer reduces build resilience, and the refresh is more reliable than the original single-shot `update || true`. Co-Authored-By: Claude Opus 4.8 <[email protected]>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1787fe5239
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # this step has no less download resilience than the original. The post-deploy | ||
| # Snyk scan is the backstop that flags a libgnutls30 left un-upgraded by an outage. | ||
| RUN (for i in 1 2 3; do apt-get update && break || sleep 5; done) \ | ||
| && (apt-get upgrade -y --no-install-recommends || true) \ |
There was a problem hiding this comment.
I checked apt-get --help, where upgrade is the command that performs package upgrades; because this upgrade is wrapped in || true, a successful package-list refresh followed by a failed GnuTLS download or dpkg upgrade still lets Docker continue into the Chromium install and produce an image with the original vulnerable libgnutls30. --fix-missing only applies to the later install, so the CVE fix should either retry/fail closed here or verify the fixed package version before continuing.
Useful? React with 👍 / 👎.
2 participants
Summary
consumer-prices-corebuilds onnode:20-slim(Debian 12) andapt-get installs Chromium for Playwright — but the Dockerfile only ever raninstall, neverupgrade. That leaves the base image's pre-installed system libraries frozen at whatever the tag shipped, which is how Snyk ends up flagging two critical GnuTLS issues inlibgnutls30:SNYK-DEBIAN12-GNUTLS28-16344325SNYK-DEBIAN12-GNUTLS28-16344303Both are fixed in
libgnutls30 3.7.9-2+deb12u7.apt-get install <chromium ...>doesn't pull that in, becauselibgnutls30is already present as a base-image transitive dependency — so apt has no reason to touch it, and it stays at the vulnerabledeb12u6.Fix
Add an explicit
apt-get upgrade -ybetweenupdateandinstall, so the pre-installed packages pick up Debian's security point-releases (libgnutls30 → 3.7.9-2+deb12u7). One-line behavioural change; the package list is untouched.RUN (apt-get update || true) \ && apt-get upgrade -y --no-install-recommends \ && apt-get install -y --fix-missing \ chromium \ ...A couple of deliberate choices:
upgrade, not--only-upgrade libgnutls30. This is a Chromium-heavy image with a large system-library surface; upgrading the whole base keeps it current against future Debian CVEs rather than playing whack-a-mole with one package at a time.apt-get updatekeeps its|| true, so the Railway build behaviour documented in fix(railway): tolerate Ubuntu apt mirror failures in NIXPACKS builds #3142 doesn't regress.Scope / what this intentionally leaves out
zlib1gfinding (SNYK-DEBIAN12-ZLIB-6008963, CVSS 9.8) has no Debian fix and can't be cleared byapt-get upgrade. Bundling a.snykignore or a base-image swap here would muddy the diff, so it's triaged separately in [SECURITY] consumer-prices-core: zlib1g integer-overflow CVE has no Debian fix — accept-risk vs. rebuild decision #4364..nvmrc) is on 22; that drift is noted in [SECURITY] consumer-prices-core: zlib1g integer-overflow CVE has no Debian fix — accept-risk vs. rebuild decision #4364 as part of the longer-term Alpine option.Type of change
Verification
3.7.9-2+deb12u7is the exact fixed version Snyk lists for both advisories, and it's the current Bookworm security release forgnutls28, so the next image rebuild + rescan should drop both GnuTLS findings. No application code paths change — this only affects the OS layer of theconsumer-prices-corecontainer image (Railway build).🤖 Generated with Claude Code