Skip to content

fix: docker-ptf May vulnerability#27334

Merged
qiluo-msft merged 1 commit into
sonic-net:masterfrom
auspham:austinpham/37938782-elastictest-security-reolve
May 15, 2026
Merged

fix: docker-ptf May vulnerability#27334
qiluo-msft merged 1 commit into
sonic-net:masterfrom
auspham:austinpham/37938782-elastictest-security-reolve

Conversation

@auspham
Copy link
Copy Markdown
Contributor

@auspham auspham commented May 13, 2026 •
edited
Loading

Why I did it

fix the current list of vulneralbity

Python (Pip) Security Update for pip (GHSA-jp4c-xjxw-mgf9)
Debian Security Update for wireshark (CVE-2026-6530)
Debian Security Update for wireshark (CVE-2026-5653)
Debian Security Update for wireshark (CVE-2026-5405)
Debian Security Update for wireshark (CVE-2026-6529)
Go (Go) Security Update for stdlib golang.org/x/net/http2 (GO-2026-4918)
Go (Go) Security Update for stdlib (GO-2026-4982)
Go (Go) Security Update for stdlib (GO-2026-4981)
Go (Go) Security Update for stdlib (GO-2026-4980)
Go (Go) Security Update for stdlib (GO-2026-4986)
Go (Go) Security Update for stdlib (GO-2026-4971)
Go (Go) Security Update for stdlib (GO-2026-4977)
Go (Go) Security Update for stdlib (GO-2026-4976)
Debian Security Update for libpng1.6 (CVE-2026-34757)
Python (Pip) Security Update for pip (GHSA-jp4c-xjxw-mgf9)

Work item tracking
  • Microsoft ADO (number only): 37938782

How I did it

Update the related packages

How to verify it

Report Summary
┌──────────────────────────────────────────────────────────────────────────────────┬────────────┬─────────────────┐
│                                      Target                                      │    Type    │ Vulnerabilities │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ docker-ptf-scan:latest (debian 12.13)                                            │   debian   │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/Pyro4-4.82.dist-info/METADATA      │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/asttokens-3.0.1.dist-info/METADATA │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/bcrypt-5.0.0.dist-info/METADATA    │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/blinker-1.9.0.dist-info/METADATA   │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/cffi-2.0.0.dist-info/METADATA      │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/click-8.3.3.dist-info/METADATA     │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/cryptography-48.0.0.dist-info/MET- │ python-pkg │        0        │
│ ADATA                                                                            │            │                 │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
│ root/env-python3/lib/python3.11/site-packages/cython-3.2.4.dist-info/METADATA    │ python-pkg │        0        │
├──────────────────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┤
<exited with exit code 0>

Which release branch to backport (provide reason below if selected)

  • 202305
  • 202311
  • 202405
  • 202411
  • 202505
  • 202511

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

@auspham auspham requested a review from lguohan as a code owner May 13, 2026 02:23
Copilot AI review requested due to automatic review settings May 13, 2026 02:23
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented May 13, 2026

/azp run Azure.sonic-buildimage

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines Bot commented May 13, 2026

Azure Pipelines successfully started running 1 pipeline(s).

Copilot AI reviewed May 13, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the docker-ptf image build to address reported security vulnerabilities by refreshing pinned toolchain components inside the container.

Changes:

  • Bump the pinned Go toolchain version (and per-arch SHA256s) used to build grpcurl/gnmic from source.
  • Add steps intended to upgrade pip within the bundled influxdb3-core Python payload and remove older pip dist-info metadata.

Comment thread dockers/docker-ptf/Dockerfile.j2 Outdated
Comment thread dockers/docker-ptf/Dockerfile.j2 Outdated
@auspham auspham force-pushed the austinpham/37938782-elastictest-security-reolve branch from 5f9d79c to 70273e8 Compare May 13, 2026 05:19
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented May 13, 2026

/azp run Azure.sonic-buildimage

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines Bot commented May 13, 2026

Azure Pipelines successfully started running 1 pipeline(s).

@auspham
fix: docker-ptf May vulnerability
dab6f12 
Signed-off-by: Austin Pham (agent) <austinpham@microsoft.com>
@auspham auspham force-pushed the austinpham/37938782-elastictest-security-reolve branch from 70273e8 to dab6f12 Compare May 14, 2026 01:41
Copilot AI review requested due to automatic review settings May 14, 2026 01:41
@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented May 14, 2026

/azp run Azure.sonic-buildimage

@azure-pipelines
Copy link
Copy Markdown

azure-pipelines Bot commented May 14, 2026

Azure Pipelines successfully started running 1 pipeline(s).

Copilot AI reviewed May 14, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

@auspham auspham mentioned this pull request May 14, 2026
Merged
8 tasks
@auspham
Copy link
Copy Markdown
Contributor Author

auspham commented May 14, 2026

/azpw retry

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented May 14, 2026

Retrying failed(or canceled) jobs...

@mssonicbld
Copy link
Copy Markdown
Collaborator

mssonicbld commented May 14, 2026

Retrying failed(or canceled) stages in build 1113150:

✅Stage Test:

  • Job Trivy vulnerability scan (docker-ptf): skipped (optional job and does not block the PR merge).
  • Job impacted-area-kvmtest-t0 by Elastictest: retried.

ZhaohuiS
ZhaohuiS approved these changes May 14, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@ZhaohuiS ZhaohuiS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Three targeted security fixes: Go 1.25.9 to 1.25.10 with correct per-arch SHA256 hashes, pip remediation scoped to influxdb3-python's bundled Python 3.13 site-packages (not the host Python 3.11 env), and removing the apt version pin before the final dist-upgrade so Debian security patches for wireshark/libpng actually get pulled in. The pip cleanup logic correctly derives the newest dist-info from the target directory itself rather than relying on the host pip version.

@eddieruan-alibaba
Copy link
Copy Markdown
Collaborator

eddieruan-alibaba commented May 14, 2026 •
edited
Loading

Would this fix be able to fix

Azure.sonic-buildimage (Test Trivy vulnerability scan (docker-ptf))Failing after 18m — Test Trivy vulnerabil

or this check would still fail for some time?

Also, what's the motivation to add this check on docker-ptf? docker-ptf would not be in production image, but a test helper docker only. Would it be worth to make this check?

@auspham
Copy link
Copy Markdown
Contributor Author

auspham commented May 14, 2026

@eddieruan-alibaba no it can only fix Go & pip3 influxdb vulnerability. #27347 this will fix the remaining. Even if it's only for test purpose it's still required us to fix it from our side

@qiluo-msft qiluo-msft merged commit c8fab6d into sonic-net:master May 15, 2026
27 of 28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@ZhaohuiS ZhaohuiS ZhaohuiS approved these changes

@eddieruan-alibaba eddieruan-alibaba eddieruan-alibaba approved these changes

@yijingyan2 yijingyan2 yijingyan2 approved these changes

@lguohan lguohan Awaiting requested review from lguohan lguohan is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@auspham @mssonicbld @eddieruan-alibaba @ZhaohuiS @yijingyan2 @qiluo-msft