From 9b121b35c7e17f472009b4a39140a15370f194d8 Mon Sep 17 00:00:00 2001 From: Tim Date: Fri, 14 Aug 2026 17:31:11 -0400 Subject: [PATCH] Document the mc-image-helper CVEs as assessed and accepted Six open Trivy findings, one critical, all inside the base image's mc-image-helper and none of them dependencies this repo chooses or can upgrade: scala-library 2.13.1 (CVE-2022-36944, critical), jackson-databind 3.1.3 (two highs), jackson-core 3.1.3, and micrometer-core 1.16.5 (the two highs PR #16 tried and failed to clear). Bumping the base image again would be churn, not a fix. MC_HELPER_VERSION on itzg's master is still 1.66.0, the version already running here, so a newer digest would change the image without changing a single affected library. PR #16 said the Trivy scan would be the verdict on that bump; the verdict is in and it did not carry the fix. The exposure assessment is deliberately not uniform, because the CVEs are not equivalent. micrometer needs a gRPC or HTTP endpoint that mc-image-helper does not serve, and scala needs Java deserialization it never performs. But jackson is different and is written up as such: the tool does parse JSON fetched from remote APIs at container start, so there is a real if narrow path there. Calling that zero-exposure would have been the comfortable answer rather than the true one. Deliberately NOT adding a Trivy ignore file. Suppressing these hides the critical and trains everyone to ignore the scanner, which matters far more the day a finding lands in our own code. Six assessed and documented findings beat zero findings and a suppression list nobody rereads. Trigger for re-evaluation is MC_HELPER_VERSION moving past 1.66.0, not a calendar date, with a backstop review at 2026-11-14. --- specs/0005-container-cve-risk-acceptance.md | 89 +++++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 specs/0005-container-cve-risk-acceptance.md diff --git a/specs/0005-container-cve-risk-acceptance.md b/specs/0005-container-cve-risk-acceptance.md new file mode 100644 index 0000000..785bd26 --- /dev/null +++ b/specs/0005-container-cve-risk-acceptance.md @@ -0,0 +1,89 @@ +--- +id: 0005 +title: Container CVE risk acceptance (mc-image-helper dependencies) +project: minecraft +status: accepted +owner: tbgorrie +created: 2026-08-14 +review: 2026-11-14 +--- + +# 0005 - Container CVE risk acceptance: mc-image-helper dependencies + +## What is being accepted + +Six open Trivy findings, all inside `usr/share/mc-image-helper-1.66.0/lib/` in the +`itzg/minecraft-server` base image. **None are dependencies this repository chooses, +installs or can upgrade.** + +| CVE | Severity | Library | +|---|---|---| +| CVE-2022-36944 | **CRITICAL** | scala-library 2.13.1 | +| CVE-2026-54513 | HIGH | jackson-databind 3.1.3 | +| CVE-2026-54512 | HIGH | jackson-databind 3.1.3 | +| CVE-2026-40984 | HIGH | micrometer-core 1.16.5 | +| CVE-2026-40983 | HIGH | micrometer-core 1.16.5 | +| GHSA-r7wm-3cxj-wff9 | error | jackson-core 3.1.3 | + +## Why upgrading is not available to us + +The base image is digest-pinned. It was bumped on 2026-08-12 from a 2026-08-01 build to a +2026-08-08 build (PR #16), specifically to try to clear the micrometer pair. **It did not +work**, and the PR said in advance that the Trivy scan would be the verdict and that the +next step would be upstream rather than re-pinning blindly. + +Checked again 2026-08-14: + +- A newer `java21` build exists, but `MC_HELPER_VERSION` on itzg's master is **still + 1.66.0**, the version we already run. The vulnerable jars are unchanged. +- Therefore a further digest bump is churn, not a fix. It would change the image without + changing a single affected library. + +The fix has to come from upstream updating mc-image-helper's dependencies. + +## Exposure assessment + +`mc-image-helper` is a **command-line tool that runs at container start** to resolve and +download mods, then exits. It is not a service, it does not listen on a port, and nothing +routes to it. + +- **micrometer (CVE-2026-40983/40984)**: both require an attacker to reach a + Micrometer-instrumented **gRPC or HTTP endpoint**. mc-image-helper serves neither. The + `AV:N` vector these CVEs need does not exist here. **Not exploitable.** +- **scala-library (CVE-2022-36944)**: requires deserializing attacker-controlled Java + serialized data. mc-image-helper does not accept serialized input from anywhere. + **Not exploitable in this configuration**, though it carries the highest score, which is + why it must be reviewed rather than dismissed. +- **jackson-databind / jackson-core**: this is the one with a real, if narrow, path. + mc-image-helper **does** parse JSON fetched over the network (Modrinth API responses) at + container start. That is remote data hitting a vulnerable parser. It is mitigated by + HTTPS, by every mod being pinned to an immutable version URL, and by the parse happening + once at boot rather than continuously, but it is **not** a zero-exposure case and should + not be described as one. + +Container hardening bounds the blast radius regardless: read-only rootfs, `USER 1000:1000`, +all capabilities dropped, `no-new-privileges`, pids capped, no Docker socket. + +## Decision + +**Accept, with an upstream report and a review date.** + +1. Do **not** bump the base image again purely for these. It changes nothing. +2. Report upstream to `itzg/mc-image-helper` so the dependencies get updated at the source, + which fixes it for every user of the image, not just us. +3. Re-evaluate when `MC_HELPER_VERSION` moves past 1.66.0. That is the trigger, not a date. +4. Review by **2026-11-14** regardless. + +## What would change this decision + +- Any of these libraries moving into the **game server** process, where it would be + reachable from a player connection. +- A published exploit against jackson that works through API-response parsing. +- mc-image-helper gaining a network listener. + +## Explicitly NOT doing + +**Not adding a Trivy ignore file.** Suppressing these would hide the critical, and the whole +point of the scan is that the next finding might be a real one in our own code. Six known, +assessed, documented findings are better than zero findings and a suppression list nobody +re-reads. The noise is the cost of keeping the signal.