Bump base image to clear two HIGH micrometer CVEs - #16
Merged
Conversation
Trivy flagged io.micrometer:micrometer-core 1.16.5 in the image: CVE-2026-40983 gRPC denial of service CVSS 7.5 CVE-2026-40984 HTTP denial of service CVSS 7.5 The jar is not something this repo installs. It lives at usr/share/mc-image-helper-1.64.0/lib/ inside itzg's base image, so the only lever here is the pinned digest. Not exploitable in this deployment, and worth saying why rather than treating a HIGH badge as self-explanatory. Both CVEs require an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint. mc-image-helper is a command-line tool that resolves and downloads mods at container start and then exits. It serves neither protocol and never listens on a port. There is no path to it from the network. Bumped regardless, because it costs nothing and an alert list full of findings nobody intends to act on is how a real one gets missed. Digest moves from ...4b6a75fd (built 2026-08-01) to ...2b9f121b (built 2026-08-08), which carries mc-image-helper 1.66.0 in place of 1.64.0. Deliberately NOT claiming this fixes it. micrometer is transitive in mc-image-helper and pinned by no build file in that repo, so the resolved version could not be confirmed by inspection. The Trivy scan on this commit is the verification. If the CVEs still appear against micrometer-core after this merges, the bump did not carry the fix, and the next step is asking itzg upstream rather than re-pinning blindly. Everything else in the Dockerfile is untouched: the sqlite-jdbc checksum gate and USER 1000:1000 both stand.
OpenSource-For-Freedom
added a commit
that referenced
this pull request
Aug 14, 2026
Six open Trivy findings, one critical, all inside the base image's mc-image-helper and none of them dependencies this repo chooses or can upgrade: scala-library 2.13.1 (CVE-2022-36944, critical), jackson-databind 3.1.3 (two highs), jackson-core 3.1.3, and micrometer-core 1.16.5 (the two highs PR #16 tried and failed to clear). Bumping the base image again would be churn, not a fix. MC_HELPER_VERSION on itzg's master is still 1.66.0, the version already running here, so a newer digest would change the image without changing a single affected library. PR #16 said the Trivy scan would be the verdict on that bump; the verdict is in and it did not carry the fix. The exposure assessment is deliberately not uniform, because the CVEs are not equivalent. micrometer needs a gRPC or HTTP endpoint that mc-image-helper does not serve, and scala needs Java deserialization it never performs. But jackson is different and is written up as such: the tool does parse JSON fetched from remote APIs at container start, so there is a real if narrow path there. Calling that zero-exposure would have been the comfortable answer rather than the true one. Deliberately NOT adding a Trivy ignore file. Suppressing these hides the critical and trains everyone to ignore the scanner, which matters far more the day a finding lands in our own code. Six assessed and documented findings beat zero findings and a suppression list nobody rereads. Trigger for re-evaluation is MC_HELPER_VERSION moving past 1.66.0, not a calendar date, with a backstop review at 2026-11-14.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two open Trivy alerts.
The findings
Both against
io.micrometer:micrometer-core1.16.5, fixed in 1.16.6 / 1.15.12.Where it comes from
usr/share/mc-image-helper-1.64.0/lib/micrometer-core-1.16.5.jarNot a dependency this repo installs. It is inside itzg base image, so the only lever is the pinned digest.
Why it is not exploitable here
Worth stating rather than treating a HIGH badge as self-explanatory. Both CVEs need an attacker to reach a Micrometer-instrumented gRPC or HTTP endpoint.
mc-image-helperis a command-line tool that resolves and downloads mods at container start, then exits. It serves no gRPC, serves no HTTP, and never listens on a port. TheAV:Nattack vector these CVEs require does not exist in this deployment.Bumping anyway, because it costs nothing and an alert list full of findings nobody intends to act on is exactly how a real one gets missed later.
The change
One line. Digest moves from
...4b6a75fd(built 2026-08-01) to...2b9f121b(built 2026-08-08), which carries mc-image-helper 1.66.0 instead of 1.64.0.Untouched: the sqlite-jdbc checksum gate,
USER 1000:1000, and every mod pin.What I am deliberately NOT claiming
I have not verified this fixes it. micrometer is a transitive dependency of mc-image-helper and is pinned by no build file in that repo, so the resolved version cannot be confirmed by inspection, and the local Docker daemon is down so the image cannot be pulled and checked either.
The Trivy scan on this commit is the verification. If the two CVEs still appear against micrometer-core after this merges, the bump did not carry the fix, and the correct next step is raising it with itzg upstream rather than re-pinning blindly and hoping.
Heads up on timing
This rebuilds the image, so the droplet will restart the server when it pulls. Combined with the When Dungeons Arise merge, that is two restarts. Worth merging when nobody is mid-session.