nevzheng opened a new issue, #13157:
URL: https://github.com/apache/gravitino/issues/13157
## Summary
The first repository-wide container scan found a substantial dependency
backlog and gaps in image discovery. Prioritize maintained image rebuilds and
verified coverage—not a blanket vulnerability-count gate.
On 2026-09-14, **40 of 43 image targets were scanned successfully; three
snapshot tags were unavailable**. Thirty-seven images had High/Critical
package-advisory matches; 33 had at least one database-recorded package fix.
These counts do not establish exploitability or the availability of compatible
replacement image tags.
## Desired outcome
Reduce validated risk in images we publish, recommend, and use in CI.
Rebuild or update affected images, preserve intentional compatibility testing,
and demonstrate improvements through targeted tests and repeat scans.
This follows the advisory monitoring work in #13156. Keep findings and scan
failures **warnings-only**. Automatic ticket filing, merge gates, and blanket
suppression are out of scope.
## Acceptance criteria
- [ ] Triage the priority groups below: record affected package locations,
relevant runtime exposure, and a remediation or reasoned deferral.
- [ ] Validate compatible replacements for the shared Java server base, Helm
database defaults, and MCP base; rebuild and scan final images, not only their
bases.
- [ ] Rebuild affected legacy CI fixtures or explicitly track remaining
exceptions, preserving required old-version test coverage.
- [ ] Add regression coverage for the missed OAuth image declaration and
reconcile discovered images against an independently checked inventory.
- [ ] Resolve the three unavailable snapshot references by identifying
intended published images or scanning actual build outputs; do not substitute
arbitrary tags.
- [ ] Record before/after image digests, scan evidence, and relevant
integration/Helm test results for each update. Failed or incomplete scans must
never count as remediation.
- [ ] Document residual coverage limits, including RustFS embedded
dependencies, runtime overrides, and architecture coverage.
## Evidence
This was a **local registry-image scan**, not a hosted workflow run or a
penetration test. No target containers were executed.
| Result | Baseline |
| --- | --- |
| Targets | 41 discovered references + RustFS pin + missed OAuth image |
| Successful / unavailable / timed out | 40 / 3 / 0 |
| Raw Critical / High matches | 3,558 / 20,923 |
| Matches with recorded package fixes | 2,774 Critical / 11,564 High |
| Distinct advisory identifiers | 2,155; not alias-deduplicated CVEs |
| Tools / platform | Syft 1.51.1; Grype 0.118.0; Linux amd64 registry images
|
| Database | v6.1.9, built 2026-09-14 06:38:38 UTC; held constant during the
sweep |
| Source revision | Monitoring branch commit
`7c3a1e7caa381ffa0231f840534a810d2d73d86c` |
Raw SBOMs, vulnerability JSON, scanner logs, and the detailed CSV are
retained locally (~2.6 GiB); they are **not yet attached to GitHub**. Appendix
B embeds the per-image summary so this issue remains readable without local
files. An accessible evidence location should be agreed before treating this
issue as the durable audit record.
## Supporting details
### Appendix A — Recommended action order
Priorities reflect deployment scope and ownership, not severity totals alone.
| Workstream | Observed evidence | Proposed action |
| --- | --- | --- |
| Shared Java server base | Temurin `17.0.16_8-jdk-jammy`: 20 High matches,
all with recorded package fixes; used by three server Dockerfiles | Refresh a
compatible Java 17 base, rebuild Gravitino/Iceberg REST/Lance REST images, test
and rescan |
| Helm database defaults | Legacy MySQL/PostgreSQL images: 82 Critical / 451
High combined | Evaluate maintained images and validate chart startup,
persistence, permissions, and upgrade compatibility |
| MCP base | `python:3.10`: 122 Critical / 509 High; includes OS/build-tool
packages | Evaluate a refreshed/minimal compatible base and test native
dependencies in the final MCP image |
| Legacy Hive/Kerberos/Ranger | Hive `0.1.13` includes `log4j-core 2.6.2` at
`/opt/apache-hive-2.3.9-bin/lib/log4j-core-2.6.2.jar`, matched to
CVE-2021-44228 | Update bundled distributions and remove unused vulnerable
archives; do not blindly replace one JAR or assume existing newer fixture tags
are clean |
| Service/plugin images | Repeated JDBC, Avro, Parquet, Netty and other
bundled-library findings in Trino and related images | Validate relevant
features/classpaths; update compatible upstream distributions and internal
wrappers |
| OAuth sample + discovery | `datastrato/sample-authorization-server:0.3.0`:
71 Critical / 399 High; Gradle's `GRAVITINO_OAUTH2_SAMPLE_SERVER` literal was
missed | Fix discovery with a regression test; coordinate a compatible
sample-image rebuild |
Source owners include
`dev/docker/{gravitino,iceberg-rest-server,lance-rest-server,mcp-server,hive,kerberos-hive,ranger,trino}/Dockerfile`,
`dev/charts/gravitino/values.yaml`, root `build.gradle.kts`, and
`clients/client-python/build.gradle.kts`.
### Appendix B — Complete initial per-image report
Counts are **package/advisory matches**, including repeated library copies.
“Fixable C/H” means a database-recorded package fix, not a validated
replacement image.
| Image | Status | Critical | High | Medium | Low | Negligible | Unknown |
Fixable C/H |
| --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | --- |
| `docker.io/apache/doris:fe-3.0.6.2` | success | 162 | 2865 | 34632 | 3925
| 228 | 0 | 68/541 |
| `docker.io/apache/doris:fe-4.0.6` | success | 121 | 2660 | 33710 | 3804 |
227 | 0 | 29/351 |
| `docker.io/apache/gravitino-ci:doris-0.1.5` | success | 212 | 3133 | 35739
| 4013 | 208 | 0 | 110/787 |
| `docker.io/apache/gravitino-ci:hive-0.1.13` | success | 613 | 1229 | 5816
| 932 | 244 | 0 | 548/1102 |
| `docker.io/apache/gravitino-ci:hive-0.1.20` | success | 576 | 1273 | 5890
| 946 | 244 | 0 | 507/1178 |
| `docker.io/apache/gravitino-ci:kerberos-hive-0.1.7` | success | 311 | 637
| 5651 | 893 | 260 | 0 | 271/581 |
| `docker.io/apache/gravitino-ci:ranger-0.1.2` | success | 133 | 480 | 353 |
59 | 975 | 5 | 123/314 |
| `docker.io/apache/gravitino-ci:trino-0.1.6` | success | 11 | 320 | 638 |
254 | 0 | 0 | 11/290 |
| `docker.io/apache/gravitino-iceberg-rest:2.0.0-SNAPSHOT` | syft-failure |
— | — | — | — | — | — | —/— |
| `docker.io/apache/gravitino-lance-rest:2.0.0-SNAPSHOT` | syft-failure | —
| — | — | — | — | — | —/— |
| `docker.io/apache/gravitino-playground:hive-0.1.15` | success | 576 | 1273
| 5890 | 946 | 244 | 0 | 507/1178 |
| `docker.io/apache/gravitino:2.0.0-SNAPSHOT` | syft-failure | — | — | — | —
| — | — | —/— |
| `docker.io/apache/kafka:3.7.0` | success | 5 | 68 | 82 | 24 | 0 | 0 | 5/52
|
| `docker.io/bitnamilegacy/mysql:8.0.36-debian-12-r12` | success | 41 | 200
| 191 | 21 | 549 | 24 | 17/126 |
| `docker.io/bitnamilegacy/postgresql:16.3.0-debian-12-r10` | success | 41 |
251 | 212 | 39 | 101 | 32 | 13/168 |
| `docker.io/curlimages/curl:latest` | success | 0 | 10 | 11 | 1 | 0 | 0 |
0/0 |
| `docker.io/library/clickhouse:24.8.14` | success | 0 | 3 | 242 | 88 | 8 |
0 | 0/0 |
| `docker.io/library/debian:buster` | success | 0 | 30 | 29 | 11 | 66 | 4 |
0/0 |
| `docker.io/library/eclipse-temurin:17.0.16_8-jdk-jammy` | success | 0 | 20
| 468 | 199 | 15 | 0 | 0/20 |
| `docker.io/library/mysql:5.7` | success | 5 | 96 | 85 | 13 | 0 | 0 | 5/96 |
| `docker.io/library/mysql:8.0` | success | 1 | 42 | 78 | 9 | 0 | 0 | 1/42 |
| `docker.io/library/mysql:8.0.33` | success | 5 | 127 | 196 | 29 | 0 | 0 |
5/127 |
| `docker.io/library/postgres:12` | success | 44 | 258 | 241 | 40 | 123 | 32
| 16/174 |
| `docker.io/library/postgres:13` | success | 43 | 230 | 183 | 36 | 105 | 52
| 42/170 |
| `docker.io/library/postgres:14` | success | 32 | 137 | 103 | 24 | 96 | 16
| 31/77 |
| `docker.io/library/postgres:15` | success | 32 | 137 | 103 | 24 | 96 | 16
| 31/77 |
| `docker.io/library/postgres:16` | success | 32 | 137 | 103 | 24 | 96 | 16
| 31/77 |
| `docker.io/library/python:3.10` | success | 122 | 509 | 528 | 186 | 892 |
27 | 71/278 |
| `docker.io/library/ubuntu:16.04` | success | 0 | 6 | 245 | 169 | 108 | 0 |
0/0 |
| `docker.io/library/ubuntu:22.04` | success | 0 | 0 | 60 | 18 | 8 | 0 | 0/0
|
| `docker.io/library/zookeeper:3.8.0` | success | 27 | 203 | 234 | 56 | 105
| 22 | 17/169 |
| `docker.io/localstack/localstack:4.14.0` | success | 68 | 378 | 332 | 63 |
587 | 47 | 43/286 |
| `docker.io/localstack/localstack:latest` | success | 23 | 85 | 73 | 10 |
553 | 44 | 7/19 |
| `docker.io/motoserver/moto:5.1.4` | success | 32 | 183 | 202 | 25 | 107 |
24 | 10/108 |
| `docker.io/oceanbase/oceanbase-ce:4.2.1-lts` | success | 2 | 143 | 542 |
399 | 2 | 0 | 2/126 |
| `docker.io/starrocks/allin1-ubuntu:3.3-latest` | success | 109 | 1556 |
13248 | 1357 | 81 | 0 | 90/962 |
| `docker.io/trinodb/trino:440` | success | 50 | 851 | 1230 | 454 | 0 | 0 |
48/814 |
| `docker.io/trinodb/trino:478` | success | 19 | 739 | 888 | 327 | 0 | 0 |
19/726 |
| `docker.io/wenjunxiao/desktop-docker-connector:latest` | success | 14 |
150 | 110 | 7 | 0 | 0 | 7/79 |
| `ghcr.io/astral-sh/uv:latest` | success | 0 | 0 | 0 | 0 | 0 | 0 | 0/0 |
| `quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z` | success | 25 | 105 |
138 | 25 | 0 | 4 | 25/101 |
|
`docker.io/rustfs/rustfs:1.0.0-rc.6@sha256:97171b3d72cd47dc81000f92ea84de25608bfc35a94c965501afaeb5d99f6035
(supplementary)` | success | 0 | 0 | 16 | 0 | 0 | 0 | 0/0 |
| `docker.io/datastrato/sample-authorization-server:0.3.0 (supplementary)` |
success | 71 | 399 | 1554 | 312 | 28 | 0 | 64/368 |
The three unavailable tags returned `MANIFEST_UNKNOWN`. They are chart
defaults, not successful clean scans.
### Appendix C — Interpretation and coverage limits
- **9,082 High/Critical matches concern `linux-*` tool packages.**
Source-package associations can attach kernel advisories to userspace tools;
this scan does not establish host-kernel exposure.
- Repeated JARs inflate totals. Package presence does not establish runtime
loading or exploitability.
- Sixteen scans lacked Go function symbols and used module-level matching;
advisories may concern unused features.
- RustFS returned 16 Medium and no High/Critical matches, but only 35 OS
packages and **no Rust crates** were inventoried. Request supplier SBOMs or
auditable build metadata. Do not infer that RustFS is safer than MinIO from
unequal coverage.
- Discovery recorded 17 unresolved dynamic/local-build declarations. The
OAuth miss is additional evidence that static discovery is incomplete.
- This baseline does not fully cover other architectures, runtime overrides,
implicit Testcontainers helper images, generated/downloaded definitions,
transitive chart defaults, or final locally built images.
- Historical per-advisory fixed versions are not current upgrade
recommendations. Validate vendor guidance and compatibility before selecting
replacements.
References: [Log4Shell
advisory](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q), [Apache Logging
security guidance](https://logging.apache.org/security.html), [Grype matching
and coverage](https://oss.anchore.com/docs/guides/vulnerability/ecosystems/).
## Related work
Related to #13154, #13155, and #13156.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
