matanper opened a new issue, #69975:
URL: https://github.com/apache/doris/issues/69975
### Search before asking
- [x] I had searched in the issues and found no similar issues.
### Version
4.1.5 official images: `apache/doris:fe-4.1.5` (`sha256:f30a1e3368d7…`),
`be-4.1.5` (`sha256:ac0301556051…`), `ms-4.1.5` (`sha256:d6b6648d37a4…`). The
4.1.4 images show the same findings.
### What's Wrong?
An Amazon Inspector scan of the official 4.1.5 images reports about 170
critical and 1,450 high CVEs per image:
| Image | Critical (unique CVEs) | High (unique CVEs) |
|---|---|---|
| fe-4.1.5 | 171 | 1,453 |
| be-4.1.5 | 168 | 1,458 |
| ms-4.1.5 | 164 | 1,428 |
Almost all of them come from what the runtime image carries besides Doris,
not from Doris itself. Below are the critical findings grouped by what needs
replacing. Unless noted, every row applies to the FE, BE and MS images.
**1. Kernel and build-only packages: 138 critical CVEs.** The `linux`,
`linux-libc-dev` and `linux-realtime` (headers, tools) packages, plus
`libc6-dev`, `libc-dev-bin`, `libcrypt-dev`, `libnsl-dev` and `rpcsvc-proto`,
are build dependencies. A container uses the host's kernel, and the runtime
doesn't need any of them.
- *Fix:* build in one stage and copy only the output into a clean runtime
stage, or `apt-get purge` them at the end of the Dockerfile.
**2. Ubuntu 22.04 packages with fixes already published:**
| Package | Fixed in | Critical CVEs |
|---|---|---|
| curl, libcurl4, libcurl3-gnutls | 7.81.0-1ubuntu1.29 | CVE-2026-8924,
CVE-2026-8925, CVE-2026-11856, CVE-2026-18924, CVE-2026-8927 |
| openssl, libssl3 | 3.0.2-0ubuntu1.29 | CVE-2026-31789, CVE-2026-34182,
CVE-2026-75803 |
| glibc (libc6, libc-bin) | 2.35-0ubuntu3.14 | CVE-2026-5450 |
| gnutls28 (libgnutls30) | 3.7.3-4ubuntu1.9 | CVE-2026-33845, CVE-2026-42010
|
| perl, perl-base, libperl5.34, perl-modules-5.34 | 5.34.0-3ubuntu1.8 |
CVE-2026-12087, CVE-2026-13221, CVE-2026-57433 |
| glib2.0 (libglib2.0-0) | 2.72.4-0ubuntu2.10 | CVE-2025-14087,
CVE-2026-58016 |
| libtasn1-6 | 4.18.0-4ubuntu0.2 | CVE-2021-46848 |
| iperf3, libiperf0 | 3.9-1+deb11u1ubuntu0.1 | CVE-2025-54349 |
| patchelf | 0.14.3-1ubuntu0.1~esm1 (Ubuntu Pro / ESM only) | CVE-2022-44940
|
- *Fix:* `apt-get update && apt-get -y upgrade` when the image is built.
iperf3 and patchelf look unneeded at runtime and could be dropped; patchelf's
fix is only in ESM.
**3. Debug tools built with Go 1.23.12:** `/opt/apache-doris/doris-debug`
and `/opt/apache-doris/dorisctl`.
| Component | Fixed in | Critical CVEs |
|---|---|---|
| go/stdlib 1.23.12 | 1.27.2 | CVE-2025-68121, CVE-2026-39821,
CVE-2026-56857, CVE-2026-78663 |
| golang.org/x/net v0.33.0 (doris-debug) | 0.60.0 | CVE-2026-39821,
CVE-2026-78663 |
- *Fix:* rebuild both tools with a current Go toolchain and `x/net`, or ship
them in a separate debug image.
**4. Oracle JDK 17.0.11** (`/usr/lib/jvm/jdk-17`): CVE-2026-91403 and
CVE-2026-114820. No free fix is available for this Oracle build.
- *Fix:* use a maintained OpenJDK 17 distribution, such as Eclipse Temurin
or Amazon Corretto, at a current update.
**5. Java libraries:**
| Library | Where | Fixed in | Critical CVEs | Note |
|---|---|---|---|---|
| spring-webmvc 6.2.19 | fe/lib | 7.0.9 | CVE-2026-47884, CVE-2026-47890 |
Already on branch-4.1 via #69282 (backport of #68862), not in 4.1.5 |
| spring-webmvc 6.2.12, jetty-http / jetty-security 12.0.29 | inside
be/lib/cdc_client/cdc-client.jar | spring 7.0.9, jetty 12.1.7 / 12.1.10 |
CVE-2026-47884, CVE-2026-47890, CVE-2026-2332, CVE-2026-10050 | The CDC client
bundles its own copies; #69282 does not reach them |
| jetty-http / jetty-security 9.4.57–9.4.58 (EOL line) | inside
fe/lib/hadoop-client-runtime-3.4.2.jar and fe/lib/hbase-shaded-jetty-4.1.13.jar
| 12.1.7 / 12.1.10 | CVE-2026-2332, CVE-2026-10050 | Needs newer Hadoop /
hbase-thirdparty artifacts, or removing them where unused |
| netty-codec-http / netty-handler 4.1.119 | inside
fe/arthas/arthas-core.jar | 4.2.13 / 4.2.17 | CVE-2026-42581, CVE-2026-42584,
CVE-2026-75595 | Arthas is a diagnostic tool; a newer Arthas, or leaving it out
of the runtime image |
| bcprov-jdk18on 1.84 | fe/lib, be/lib/hadoop_hdfs/lib, ms/lib/hadoop_hdfs |
1.85 | CVE-2026-8763 | |
### What You Expected?
The official runtime images carry only what Doris needs at runtime, with
current OS and library patches. Most of the findings above go away with:
- a multi-stage build;
- `apt-get upgrade` at build time;
- a maintained OpenJDK;
- debug tools rebuilt or kept out of the runtime image.
The Java library rows need dependency bumps; spring and jetty are partly
done on branch-4.1 already.
### How to Reproduce?
Scan `apache/doris:{fe,be,ms}-4.1.5` with any image scanner that reads OS
packages, Go binaries and embedded Java dependencies. These results come from
Amazon Inspector; Trivy or Grype should report the same packages.
### Anything Else?
Applying these changes as a layer on top of the 4.1.4 images (upgrade,
purge, OpenJDK swap, jar bumps, debug tools removed) left 1–7 critical CVEs per
image. The FE, BE and MS still start, and queries behave the same, including
JNI on the BE. The remainder is the Jetty and Spring rows, which need the
dependency upgrades above.
### Are you willing to submit PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
