From aa8c3e1ec8b211a79905575f40a83f4ca4ad2294 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Wed, 12 Aug 2026 16:06:00 +0200 Subject: [PATCH 1/4] ROX-36081: remove curl, vim, python3 from scanner-db image Expand rpm -e glob patterns to match curl-minimal/libcurl-minimal, vim-minimal, and python3 packages that are not needed at runtime and carry HIGH CVEs flagged in GovCloud compliance scans. Mirrors the fix applied to central-db and scanner-v4-db in stackrox/stackrox#22269. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 --- image/db/rhel/konflux.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index f7a6cbba3..b2b464641 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -37,7 +37,7 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \ chown -R postgres:postgres /var/lib/postgresql && \ chown -R postgres:postgres /var/run/postgresql && \ dnf clean all && \ - rpm --verbose -e --nodeps $(rpm -qa curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm --verbose -e --nodeps $(rpm -qa 'curl*' 'libcurl*' 'vim*' 'python3*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum && \ mkdir /docker-entrypoint-initdb.d From 42c1dac7a6a63fa3a9b429a7891727ec701a6c86 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Thu, 13 Aug 2026 15:03:26 +0200 Subject: [PATCH 2/4] ROX-36081: fix scanner-db package removal pattern Remove python3 from removal list (needed by postgresql-upgrade). Add libcurl and vim to removal list (carry unfixable CVEs). Use glob pattern 'curl*' to match curl-minimal. Add comments explaining removal rationale. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 --- image/db/rhel/Dockerfile | 7 +++++-- image/db/rhel/Dockerfile.slim | 7 +++++-- image/db/rhel/konflux.Dockerfile | 6 +++++- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/image/db/rhel/Dockerfile b/image/db/rhel/Dockerfile index bffbfc43f..5d698f3b0 100644 --- a/image/db/rhel/Dockerfile +++ b/image/db/rhel/Dockerfile @@ -69,8 +69,11 @@ RUN microdnf upgrade -y --nobest && \ # https://access.redhat.com/solutions/5616681 microdnf reinstall -y tzdata && \ microdnf clean all && \ - # (Optional) Remove line below to keep package management utilities - rpm -e --nodeps $(rpm -qa shadow-utils curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm -e --nodeps $(rpm -qa shadow-utils \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \ localedef -f UTF-8 -i en_US en_US.UTF-8 && \ mkdir /docker-entrypoint-initdb.d diff --git a/image/db/rhel/Dockerfile.slim b/image/db/rhel/Dockerfile.slim index 8e3bb7d34..08c67ce49 100644 --- a/image/db/rhel/Dockerfile.slim +++ b/image/db/rhel/Dockerfile.slim @@ -69,8 +69,11 @@ RUN microdnf upgrade -y --nobest && \ # https://access.redhat.com/solutions/5616681 microdnf reinstall -y tzdata && \ microdnf clean all && \ - # (Optional) Remove line below to keep package management utilities - rpm -e --nodeps $(rpm -qa shadow-utils curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm -e --nodeps $(rpm -qa shadow-utils \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \ localedef -f UTF-8 -i en_US en_US.UTF-8 && \ mkdir /docker-entrypoint-initdb.d diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index b2b464641..cd9186904 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -37,7 +37,11 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \ chown -R postgres:postgres /var/lib/postgresql && \ chown -R postgres:postgres /var/run/postgresql && \ dnf clean all && \ - rpm --verbose -e --nodeps $(rpm -qa 'curl*' 'libcurl*' 'vim*' 'python3*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm --verbose -e --nodeps $(rpm -qa \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum && \ mkdir /docker-entrypoint-initdb.d From ad003d4aaeb39e4c91ea6dc9d0042a5c6b2ccf11 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Mon, 31 Aug 2026 18:43:44 +0200 Subject: [PATCH 3/4] Remove rsync from scanner database images Remove rsync package from scanner-db and scanner-db-slim images as it carries 8-9 unfixable CVEs (CVE-2026-53783, CVE-2026-53803, CVE-2026-53613), including critical severity issues. rsync is a file synchronization utility inherited from the postgresql-15 base image but is not needed for PostgreSQL database operations in containerized deployments. This follows the same pattern as the removal of curl, vim, and package managers from these images, and matches the fix applied to central-db and scanner-v4-db in the stackrox/stackrox repo. User request: "we need to make similar commit on ../scanner branch ROX-36081-remove-unused-pkgs and push it" Co-Authored-By: Claude Sonnet 4.5 --- image/db/rhel/konflux.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index cd9186904..c6431b8ae 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -39,7 +39,7 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \ dnf clean all && \ rpm --verbose -e --nodeps $(rpm -qa \ # Not needed by postgres, carry unfixable CVEs - 'libcurl*' 'vim*' \ + 'libcurl*' 'vim*' 'rsync*' \ # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum && \ From 9d5603bb91879717c41129e07b445cdd138590a9 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Mon, 31 Aug 2026 18:47:01 +0200 Subject: [PATCH 4/4] Remove rsync from non-Konflux scanner database images Remove rsync package from scanner-db and scanner-db-slim non-Konflux Dockerfiles (Dockerfile and Dockerfile.slim) to match the fix already applied to konflux.Dockerfile. This ensures all scanner database image variants (Konflux and non-Konflux builds) have the same rsync removal, addressing CVEs CVE-2026-53783, CVE-2026-53803, CVE-2026-53613. User request: "I think we need to do that in image/db/rhel/Dockerfile and image/db/rhel/Dockerfile.slim" Co-Authored-By: Claude Sonnet 4.5 --- image/db/rhel/Dockerfile | 2 +- image/db/rhel/Dockerfile.slim | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/image/db/rhel/Dockerfile b/image/db/rhel/Dockerfile index 5d698f3b0..eb014a698 100644 --- a/image/db/rhel/Dockerfile +++ b/image/db/rhel/Dockerfile @@ -71,7 +71,7 @@ RUN microdnf upgrade -y --nobest && \ microdnf clean all && \ rpm -e --nodeps $(rpm -qa shadow-utils \ # Not needed by postgres, carry unfixable CVEs - 'libcurl*' 'vim*' \ + 'libcurl*' 'vim*' 'rsync*' \ # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \ diff --git a/image/db/rhel/Dockerfile.slim b/image/db/rhel/Dockerfile.slim index 08c67ce49..90caf6f69 100644 --- a/image/db/rhel/Dockerfile.slim +++ b/image/db/rhel/Dockerfile.slim @@ -71,7 +71,7 @@ RUN microdnf upgrade -y --nobest && \ microdnf clean all && \ rpm -e --nodeps $(rpm -qa shadow-utils \ # Not needed by postgres, carry unfixable CVEs - 'libcurl*' 'vim*' \ + 'libcurl*' 'vim*' 'rsync*' \ # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \