UID2-7760: bump eclipse-temurin digest to fix sqlite-libs CVE-2026-11822/11824 - #425
Merged
Merged
Conversation
…(exp 2026-09-27)
…-27; drop stale PR #631 reference
Contributor
Author
|
Added a follow-up commit: extended two other expired .trivyignore entries (libexpat CVE-2026-56131/56407, jackson-core GHSA-r7wm-3cxj-wff9) to 2026-09-27 and corrected a stale PR reference in the jackson comment, per UID2-7763. |
… CVEs Confirmed via direct image inspection that a newer build of the same eclipse-temurin:21-jre-alpine-3.23 tag ships fixed sqlite-libs, libexpat, and p11-kit versions, so the suppressions for CVE-2026-11822/11824, CVE-2026-2100, and CVE-2026-56131/56407/56408 are no longer needed.
BehnamMozafari
changed the title
swibi-ttd
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CVE-2026-11822 and CVE-2026-11824 (HIGH, sqlite-libs) were flagged in the Alpine base image (eclipse-temurin:21-jre-alpine-3.23). Originally suppressed in
.trivyignoreas non-exploitable (uid2-optout has no SQLite/JDBC dependency), but a newer build of the same pinned tag turned out to already ship fixed versions of sqlite-libs (and libexpat, p11-kit) — confirmed by pulling and inspecting the image directly (apk list -I), not just trusting the Alpine package index.This PR bumps the pinned digest to that build instead of continuing to suppress, and removes the now-unnecessary
.trivyignoreentries for CVE-2026-11822/11824, CVE-2026-2100 (p11-kit), and CVE-2026-56131/56407/56408 (libexpat).Jira: https://thetradedesk.atlassian.net/browse/UID2-7760
Test plan
mvn package+docker buildwith the new digest, thentrivy image --severity HIGH,CRITICALagainst the built image — 0 findings