Skip to content

Commit 5195424

Browse files
Kaniska244AlvaroRausell
Kaniska244
and
AlvaroRausell
authored
Fix for vulnerability issue CVE-2024-46901 (devcontainers#1506)
* [ruby] - Fix for vulnerability issue CVE-2024-46901 * Merging the changes for all images into one PR. * Further changes to separate the update svn code snippet in a script. * Correcting the mistakes. * Removing the script from tmp direct once executed. * Adding changes for Go and Rust * Adding test script for rust --------- Co-authored-by: Álvaro Rausell Guiard <33221237+AlvaroRausell@users.noreply.github.com>
1 parent 18ca164 commit 5195424

File tree

28 files changed

+274
-7
lines changed

28 files changed

+274
-7
lines changed

‎src/go/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
ARG VARIANT=1.25-bookworm
22
FROM golang:${VARIANT}
33

4+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
5+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
6+
RUN chmod +x /tmp/install-subversion.sh
7+
RUN /tmp/install-subversion.sh \
8+
&& rm -f /tmp/install-subversion.sh
9+
410
# [Optional] Uncomment the next line to use go get to install anything else you need
511
# RUN go get -x <your-dependency-or-tool>
612

‎src/go/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/go/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.4.5",
2+
"version": "1.4.6",
33
"variants": [
44
"1.25-bookworm",
55
"1.24-bookworm",

‎src/go/test-project/test.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
2424

2525
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
2626

27+
# Testing vulnerability issue CVE-2024-46901 fix by upgrading svn to 1.14.5.
28+
svn_version=$(svn --version --quiet)
29+
check-version-ge "svn-requirement" "${svn_version}" "1.14.5"
30+
2731
check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme
2832
check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme
2933

‎src/javascript-node/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,12 @@ RUN \
2222
&& su ${USERNAME} -c "umask 0002 && npm install -g eslint" \
2323
&& npm cache clean --force > /dev/null 2>&1
2424

25+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
26+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
27+
RUN chmod +x /tmp/install-subversion.sh
28+
RUN /tmp/install-subversion.sh \
29+
&& rm -f /tmp/install-subversion.sh
30+
2531
# [Optional] Uncomment this section to install additional OS packages.
2632
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
2733
# && apt-get -y install --no-install-recommends <your-package-list-here>

‎src/javascript-node/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

‎src/javascript-node/manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "3.0.2",
2+
"version": "3.0.3",
33
"variants": [
44
"24-bookworm",
55
"22-bookworm",

‎src/javascript-node/test-project/test.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ check "gitconfig-contains-name" sh -c "cat /etc/gitconfig | grep 'name = devcont
3333

3434
check "usr-local-etc-config-does-not-exist" test ! -f "/usr/local/etc/gitconfig"
3535

36+
# Testing vulnerability issue CVE-2024-46901 fix by upgrading svn to 1.14.5.
37+
svn_version=$(svn --version --quiet)
38+
check-version-ge "svn-requirement" "${svn_version}" "1.14.5"
39+
3640
check "Oh My Zsh! theme" test -e $HOME/.oh-my-zsh/custom/themes/devcontainers.zsh-theme
3741
check "zsh theme symlink" test -e $HOME/.oh-my-zsh/custom/themes/codespaces.zsh-theme
3842

‎src/jekyll/.devcontainer/Dockerfile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,12 @@ RUN chown -R "vscode:rvm" "/usr/local/rvm/" \
2525

2626
COPY post-create.sh /usr/local/post-create.sh
2727

28+
# Fixing vulnerability issue by upgrading svn to 1.14.5. Ref https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
29+
COPY ./scripts/install-subversion.sh /tmp/install-subversion.sh
30+
RUN chmod +x /tmp/install-subversion.sh
31+
RUN /tmp/install-subversion.sh \
32+
&& rm -f /tmp/install-subversion.sh
33+
2834
# [Optional] Uncomment this section to install additional OS packages.
2935
# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
3036
# && apt-get -y install --no-install-recommends <your-package-list-here>

‎src/jekyll/.devcontainer/scripts/install-subversion.sh‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
URL="https://archive.apache.org/dist/subversion/subversion-1.14.5.tar.gz"
5+
TMP="/tmp"
6+
TARBALL="subversion-1.14.5.tar.gz"
7+
SRCDIR="subversion-1.14.5"
8+
9+
if wget -q -O "${TMP}/${TARBALL}" "${URL}"; then
10+
echo "Downloaded ${TARBALL} — building..."
11+
apt-get remove -y subversion libsvn1 || true
12+
cd "${TMP}"
13+
tar -xzf "${TARBALL}"
14+
cd "${SRCDIR}"
15+
apt-get update -y
16+
apt-get install -y --no-install-recommends build-essential autoconf libtool libsqlite3-dev pkg-config libapr1-dev libaprutil1-dev liblz4-dev libutf8proc-dev zlib1g-dev
17+
./configure --with-lz4=internal --prefix=/usr
18+
make -j"$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1)"
19+
make install
20+
cd /
21+
rm -rf "${TMP:?}/${SRCDIR}" "${TMP:?}/${TARBALL}"
22+
apt-get purge -y --auto-remove build-essential autoconf libtool pkg-config
23+
rm -rf /var/lib/apt/lists/*
24+
echo "Subversion built and installed (build deps removed)"
25+
else
26+
echo "Downloading svn source failed, skipping Subversion build"
27+
fi
28+

0 commit comments

Comments
 (0)