The current image has vulnerabilities, so can we release new one with newer alpine updates

[rambangaru]

Pre issue-raising checklist

I have already (please mark the applicable with an x):

• [ X ] Confirmed this is the right place to raise the issue - only issues related to the Dockerization of the Pact Broker should be raised here. Issues related to the Pact Broker application itself should be raised in the Pact Broker project.
• [ X ] Upgraded to the latest Pact Broker Docker image OR
• [ X ] Checked the CHANGELOG to see if the issue I am about to raise has been fixed
• Read the Troubleshooting page

Software versions

• pact-broker docker version: 2.112.0
• OS: ANY
• pact broker client details: ANY

Expected behaviour

Image with latest OS updates and no vulnerabilities

Actual behaviour

Image is with known vulnerabilities

Steps to reproduce

Run any kind of security scan to identify the vulnerabiliites

Relevent log files

[YOU54F]

Run any kind of security scan to identify the vulnerabiliites

Please note it isn't fair on maintainers of open source software, for a very vague report of vulnerabilities. We would appreciate at minimum the tool you have used, and the vulnerability you believe is present, otherwise we would suggest to look at our own trivy scan. If the particular vulnerability isn't caught by trivy, then that would be an issue for that project and they would also require sufficient actionable information.

What specific vulnerabilities are you referring to?

We do run an audit on a cron job

• https://github.com/pact-foundation/pact-broker-docker/actions/workflows/audit.yml

Which recently started failure due to a CVE in Sinatra

2024-12-05T04:53:56Z	INFO	Detected OS	family="alpine" version="3.20.3"
2024-12-05T04:53:56Z	INFO	[alpine] Detecting vulnerabilities...	os_version="3.20" repository="3.20" pkg_num=77
2024-12-05T04:53:56Z	INFO	Number of language-specific files	num=1
2024-12-05T04:53:56Z	INFO	[bundler] Detecting vulnerabilities...

fcbe10f906a8 (alpine 3.20.3)
============================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


pact_broker/Gemfile.lock (bundler)
==================================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ sinatra │ CVE-2024-21510 │ MEDIUM   │ fixed  │ 3.2.0             │ >= 4.1.0      │ sinatra: Open Redirect Vulnerability in Sinatra via │
│         │                │          │        │                   │               │ X-Forwarded-Host Header                             │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-21510          │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

Linked CVE:- https://avd.aquasec.com/nvd/2024/cve-2024-21510/

Unfortunately resolving that isn't trivial for us in the Pact Broker, as it requires Sinatra 4, requires Rack 3, which webmachine doesn't yet support of which the Pact Broker depends on.

The SmartBear PactFlow team have recently hired a new Ruby Senior Engineer who will be allocating time towards our open source projects including the Pact Broker, so this particular issue is on his radar.

[YOU54F]

Our current release process is blocked due the the above CVE.

Tracking issue raised in the pact_broker project.

Have proposed skipping the CVE in this project which consumes the pact_broker in order to allow updates outside Sinatra to still proceed, as the current released version is still in the same vulnerable state as the image we wish to deploy, in relation to the CVE.

(It adds no value blocking the deployment of any changes in this project, based on the audit, unless we were adding new vulnerable code, that wasn't present in the deployed image - which isn't the case in this instance)

[YOU54F]

New image going out now which will contain

• chore(deps): bump ruby from 3.3.5-alpine3.20 to 3.3.6-alpine3.20 #214
• chore(deps): bump pg from 1.5.8 to 1.5.9 in /pact_broker #213

[github-actions]

🤖 Great news! We've labeled this issue as smartbear-supported and created a tracking ticket in PactFlow's Jira (PACT-2961). We'll keep work public and post updates here. Meanwhile, feel free to check out our docs. Thanks for your patience!