From bd28b7ccba17ef47251bc078a2b566b6040a9a45 Mon Sep 17 00:00:00 2001 From: George Karr Date: Wed, 17 Jun 2026 14:46:32 -0500 Subject: [PATCH] Patch openssl in fleet-docker image to resolve CVE-2026-34182 (#47719) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Related issue:** Resolves #47524 # Checklist for submitter - [x] QA'd all new/changed functionality manually ## Context [CVE-2026-34182](https://nvd.nist.gov/vuln/detail/CVE-2026-34182) (CVSS 9.1, Critical) is an OpenSSL CMS `AuthEnvelopedData` input-validation flaw fixed in `openssl 3.5.7-r0`. The Alpine base image used by `fleetdm/fleet` ships `3.5.6-r0`, which scanners (Aikido, Trivy) flag on our published image. `fleet serve` itself is statically compiled and does not link OpenSSL, so the running process is unaffected — but the package is present in the base image and shows up in customer-side SBOM scans. ## Approach The issue's preferred path is a base-image SHA bump to `alpine:3.23.5`. Docker Hub's latest `3.23.x` tag is still `3.23.4` (pushed 2026-04-15), so that path isn't yet available. Applying the issue's fallback: ```dockerfile RUN apk --no-cache upgrade openssl libcrypto3 libssl3 ``` This pulls the patched `openssl 3.5.7-r0` from the Alpine 3.23 repos at image build time without waiting on a new base tag. Once `alpine:3.23.5` lands we can revert to a clean SHA-pinned `FROM` bump per the pattern in #43671. ## Scope Limited to `tools/fleet-docker/Dockerfile` per the issue's scope guidance. Other Dockerfiles pinned to the same Alpine SHA (loadtest, scep, mdmproxy) are out of scope here. ## Test plan - [ ] CI image build passes. - [ ] Trivy/scanner re-scan of the resulting `fleetdm/fleet` image confirms CVE-2026-34182 is gone and `openssl` reports `3.5.7-r0`. ## Summary by CodeRabbit * **Chores** * Updated OpenSSL and related packages in Docker image build configuration to ensure the latest versions are included during image creation. --- tools/fleet-docker/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/fleet-docker/Dockerfile b/tools/fleet-docker/Dockerfile index 7272bbec32..5f6a1431d4 100644 --- a/tools/fleet-docker/Dockerfile +++ b/tools/fleet-docker/Dockerfile @@ -10,6 +10,7 @@ LABEL org.opencontainers.image.documentation="https://fleetdm.com/docs" RUN apk --update add ca-certificates RUN apk --no-cache add jq +RUN apk --no-cache upgrade openssl libcrypto3 libssl3 # Create fleet group and user RUN addgroup -S fleet && adduser -S fleet -G fleet