fix(security): track libnss3 CVE-2026-16389 in ingestion Docker images#30392
Draft
harshsoni2024 wants to merge 1 commit into
Draft
fix(security): track libnss3 CVE-2026-16389 in ingestion Docker images#30392harshsoni2024 wants to merge 1 commit into
harshsoni2024 wants to merge 1 commit into
Conversation
libnss3 enters the ingestion and operator images transitively via the JRE (openjdk-17-jre-headless hard-depends on libnss3 on bookworm), so it cannot be removed while Java-based ingestion (Spark, ANTLR) is supported. No commit introduced it — CVE-2026-16389 was published recently and matched the already-present package. Add libnss3/libnss3-tools to the existing --only-upgrade list so a rebuild pulls the Debian fix automatically once it lands. bookworm-security is still on the vulnerable 2:3.87.1-1+deb12u3 (fix only in sid), so this is a no-op today, matching the wget-tracking pattern. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
❌ PR checklist incompleteThis PR cannot be merged until the following are addressed on its linked issue:
The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically. Maintainers can bypass this check by adding the |
github-actions
Bot
added
Ingestion
safe to test
Code Review ✅ ApprovedAdds libnss3 and libnss3-tools to the apt upgrade list in ingestion Docker images to track CVE-2026-16389. No issues found. OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
Contributor
There was a problem hiding this comment.
Pull request overview
Tracks CVE-2026-16389 for Debian bookworm-based ingestion images by ensuring libnss3 (and related tooling) are included in the existing apt-get --only-upgrade security-upgrade list, so future bookworm-security backports are automatically picked up on rebuild.
Changes:
- Add
libnss3andlibnss3-toolsto the--only-upgradeapt package list in the ingestion image Dockerfile. - Add the same packages to the operator base image Dockerfile.
- Extend the in-file tracking comments to document the CVE status/backport expectation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| ingestion/Dockerfile | Adds libnss3/libnss3-tools to the security-only upgrade list and documents CVE tracking status. |
| ingestion/operators/docker/Dockerfile | Mirrors the same libnss3/libnss3-tools tracking and upgrade behavior for operator images. |
Comment on lines
54
to
+58
| && apt-get -qq install -y --only-upgrade \ | ||
| libgnutls30 libcap2 libcap2-bin openssh-client rsync sudo \ | ||
| libpam0g libpam-modules libpam-modules-bin libpam-runtime \ | ||
| curl libcurl4 libcurl3-gnutls libmariadb3 wget \ | ||
| libnss3 libnss3-tools \ |
Comment on lines
61
to
+65
| && apt-get -qq install -y --only-upgrade \ | ||
| libgnutls30 libcap2 libcap2-bin openssh-client rsync sudo \ | ||
| libpam0g libpam-modules libpam-modules-bin libpam-runtime \ | ||
| curl libcurl4 libcurl3-gnutls libmariadb3 wget \ | ||
| libnss3 libnss3-tools \ |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| libpam0g libpam-modules libpam-modules-bin libpam-runtime \ | ||
| curl libcurl4 libcurl3-gnutls libmariadb3 wget \ | ||
| libnss3 libnss3-tools \ | ||
| && apt-get -qq purge -y \ |
Contributor
There was a problem hiding this comment.
When Debian publishes the patched bookworm-security package, production builds upgrade NSS but the CI Dockerfiles used by the Trivy scan and operator build omit these packages, causing CI to build and scan a different, vulnerable configuration instead of validating the remediation.
|
Contributor
🟡 Playwright Results — all passed (25 flaky)✅ 4538 passed · ❌ 0 failed · 🟡 25 flaky · ⏭️ 95 skipped
🟡 25 flaky test(s) (passed on retry)
How to debug locally# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip # view trace |
harshsoni2024
marked this pull request as draft
July 24, 2026 11:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Track
CVE-2026-16389(NSS integer overflow / incorrect boundaryconditions) in the ingestion and operator Docker images by adding
libnss3andlibnss3-toolsto the existing--only-upgradeapt list.Why
libnss3is not removable. It is a transitive dependency of the Javaruntime — on Debian bookworm,
openjdk-17-jre-headlesshard-depends onlibnss3 (>= 2:3.17.1). Both images install a JRE (Spark, ANTLR, andother Java-backed ingestion paths need it), so NSS is always present.
CVE-2026-16389was newly published (the fix shipped in Firefox /Thunderbird 153) and scanners matched it against the pre-existing
package — not because of a Dockerfile change.
add the package to
--only-upgradeso the Debian security patch is pickedup automatically on the next rebuild, with no further code change needed.
Current status
Per the Debian Security Tracker,
the fix is not yet backported to bookworm:
2:3.87.1-1+deb12u22:3.87.1-1+deb12u32:3.126-1So this change is a no-op today —
--only-upgradedoes nothing untilDebian ships
+deb12u4. It is a forward-looking fix that requires nofollow-up PR once the patch lands. Scanners will continue to report the CVE
until then, since the vulnerable library genuinely remains installed.
Changes
ingestion/Dockerfile— addlibnss3 libnss3-tools+ tracking commentingestion/operators/docker/Dockerfile— same🤖 Generated with Claude Code
Greptile Summary
Updates the ingestion container security-upgrade lists to track the pending Debian fix for CVE-2026-16389.
libnss3andlibnss3-toolsto the production ingestion image’sapt --only-upgradeinvocation.Confidence Score: 4/5
The CI Dockerfiles must be updated before merging so image builds and vulnerability scans validate the same NSS remediation as the production Dockerfiles.
The production images will automatically consume the patched NSS package when Debian publishes it, but CI builds use separate Dockerfiles that omit the new packages and will therefore continue building and scanning the vulnerable configuration.
ingestion/Dockerfile, ingestion/operators/docker/Dockerfile, ingestion/Dockerfile.ci, ingestion/operators/docker/Dockerfile.ci
Security Review
The production Dockerfiles track the pending NSS fix, but their CI counterparts remain unchanged; consequently, CI builds and vulnerability scans will not validate the remediation once the patched Debian package becomes available.
Important Files Changed
Reviews (1): Last reviewed commit: "fix(security): track libnss3 CVE-2026-16..." | Re-trigger Greptile