Skip to content

chore(cloud-native): upgrade libs to reduce vulnerabilities #10168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 18, 2024
Merged

Conversation

iromli
Copy link
Contributor

@iromli iromli commented Nov 15, 2024

Prepare


Description

Target issue

closes #10167

Implementation Details


Test and Document the changes

  • Static code analysis has been run locally and issues have been fixed
  • Relevant unit and integration tests have been added/updated
  • Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

  • I confirm that there is no impact on the docs due to the code changes in this PR.

Signed-off-by: iromli <isman.firmansyah@gmail.com>
@iromli iromli requested a review from moabu as a code owner November 15, 2024 19:51
Copy link

dryrunsecurity bot commented Nov 15, 2024

DryRun Security Summary

The provided code changes update the Docker images for various components of the Janssen application, including Jetty version upgrades, build date updates, secure configuration management, non-root user execution, asset synchronization, and dependency management, all focused on maintaining the security and stability of the application.

Expand for full summary

Summary:

The provided code changes are related to updating the Docker images for various components of the Janssen application, including the Config API, Casa, Cert Manager, Auth Server, FIDO2, Link, Configurator, Keycloak Link, and SCIM server. The key updates across these components are:

  1. Jetty Version Upgrades: The Jetty version has been updated from 11.0.20 to 11.0.24 across multiple components. Upgrading the underlying framework to the latest version is a security best practice, as it often includes bug fixes and security improvements.

  2. Build Date Updates: The build dates for the various components have been updated, indicating that new versions or releases of the applications have been created. While this change alone does not have direct security implications, it's important to ensure that the updated versions do not introduce any new vulnerabilities.

  3. Secure Configuration Management: The Dockerfiles include the configuration of various environment variables related to configuration adapters (Consul, Vault, Kubernetes), secrets, and persistence. Ensuring the secure handling and storage of these sensitive values is crucial for the application's security.

  4. Non-Root User Execution: All the Dockerfiles create a non-root user to run the applications, which is a recommended security practice to minimize the potential impact of any vulnerabilities or attacks.

  5. Asset Synchronization: Several Dockerfiles include steps to synchronize static assets, such as configuration files, schemas, and templates, from a Git repository. Maintaining the integrity and security of these assets is important for the overall security of the application.

  6. Dependency Management: The Dockerfiles ensure that all necessary dependencies, including Python libraries and Java components, are properly installed and up-to-date. Keeping dependencies secure is a crucial aspect of maintaining the application's security posture.

Overall, the code changes appear to be focused on maintaining the security and stability of the Janssen application by keeping dependencies up-to-date, implementing security best practices, and ensuring a secure configuration and deployment process.

Files Changed:

  1. docker-jans-config-api/Dockerfile: Updates the Jetty version and the build date for the Jans Config API server.
  2. docker-jans-casa/Dockerfile: Updates the Jetty version used in the Docker image for the Jans Casa application.
  3. docker-jans-certmanager/Dockerfile: Updates the build date for the "jans-auth-client" JAR file used by the "jans-certmanager" component.
  4. docker-jans-auth-server/Dockerfile: Updates the Jetty version and the build date for the Jans Authorization Server.
  5. docker-jans-fido2/Dockerfile: Updates the Jetty version and the build date for the FIDO2 server component.
  6. docker-jans-link/Dockerfile: Updates the Jetty version and the build date for the Jans Link component.
  7. docker-jans-configurator/Dockerfile: Updates the dependency versions and the build date for the Jans Configurator application.
  8. docker-jans-keycloak-link/Dockerfile: Updates the Jetty version, Jython version, and the Keycloak Link server version.
  9. docker-jans-scim/Dockerfile: Updates the Jetty version and the build date for the Jans SCIM server.

Code Analysis

We ran 9 analyzers against 9 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 9 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

@moabu moabu merged commit fd255fc into main Nov 18, 2024
10 of 11 checks passed
@moabu moabu deleted the cn-sync-image branch November 18, 2024 05:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

chore(cloud-native): upgrade libs to reduce vulnerabilities
3 participants