Bump Alpine base image to resolve CVE-2026-34182 (openssl 3.5.7-r0)

[lukeheath]

Context

CVE-2026-34182 (NVD CVSS 9.1, Critical) is an OpenSSL Cryptographic Message Services (CMS) input-validation flaw in AuthEnvelopedData parsing. Disclosed 2026-06-09.

Aikido flagged it on the current fleetdm/fleet container build: openssl 3.5.6-r0 is installed in the Alpine base, fixed in 3.5.7-r0.

Exposure

Low for the running Fleet process. tools/fleet-docker/Dockerfile produces a static Go binary that does not link to OpenSSL — fleet serve never loads libcrypto/libssl. The vulnerable library and CLI are present in the base image but unused by the service.

Worth fixing for:

• Customer-side image scanners (Trivy, Snyk, etc.) flag this as Critical in SBOMs we publish.
• Defense in depth (any kubectl exec debugging that shells out to openssl would hit the vulnerable lib).

Action

Alpine v3.23 repos already carry openssl 3.5.7-r0, but Docker Hub's latest 3.23 patch is still 3.23.4 (pushed 2026-04-15). Two paths depending on timing:

1. Preferred — wait for alpine:3.23.5 and bump the pinned FROM alpine:3.23.4@sha256:... in tools/fleet-docker/Dockerfile. Matches the prior remediation pattern (Fleet and fleetctl container images shipping outdated Alpine base with multiple high-severity CVEs in OpenSSL #43671 for the 3.23.3 → 3.23.4 bump).
2. Fallback if Alpine takes >1 week — add RUN apk --no-cache upgrade openssl libcrypto3 libssl3 to the Dockerfile to pull the patched package from Alpine repos without waiting for a new base tag. Removes the immutable SHA pin on the openssl version but closes the finding immediately.

Scope check

Only tools/fleet-docker/Dockerfile pins alpine:3.23.4. Sibling Dockerfiles (fleetctl-docker, bomutils-docker, wix-docker, vulnerability-dashboard) use different bases and don't need changes from this CVE.

How we'll know to act

• Daily Aikido feed alert (already firing).
• Daily Trivy scan of the main-branch image, once Add daily Trivy scan of fleetdm/fleet built from main #47518 lands (will fire as soon as Trivy DB ingests this CVE from Alpine secdb).
• Manual check of Docker Hub for alpine:3.23.5 availability — curl -sS "https://hub.docker.com/v2/repositories/library/alpine/tags?name=3.23".

[lukeheath]

@lukeheath welcome back — here is the CVE-2026-34182 status:

PR #47518 — Daily Trivy scan of main Docker image

Status: open, not yet merged. The fleet-release bot approved on 2026-06-12, but none of the four requested human reviewers (@georgekarrv, @lucasmrod, @getvictor, @sharon-fdm) have reviewed yet. One CI check is failing: Analyze GitHub Actions workflows (CodeQL scan of the new workflow file). CodeRabbit also flagged two actionable issues that should be addressed before merge:

1. actions/checkout is pinned to a v3 SHA — needs to be updated to v4 (matching other workflows).
2. VEX files are passed as a single comma-separated argument to --vex; Trivy requires a separate --vex flag per file.

Issue #47524 / Alpine 3.23.5 status

This issue remains open. No comments have been added since it was filed on 2026-06-12. alpine:3.23.5 is not yet published on Docker Hub — the latest 3.23.x release is still 3.23.4 (pushed 2026-04-15, over two months ago). CVE-2026-34182 was disclosed 2026-06-09, so Alpine has now been slow for 8 days with no new 3.23 patch in sight.

Recommended next step

The >7-day threshold documented in this issue has been crossed. The inline apk fallback closes the Aikido finding immediately without waiting for a new Docker Hub tag:

RUN apk --no-cache upgrade openssl libcrypto3 libssl3

This relaxes the immutable pin on the openssl version but resolves the scanner alert now. @lukeheath please advise: apply the apk fallback now, continue waiting for 3.23.5, or both? Happy to open the fallback PR on your go-ahead.

---

Generated by Claude Code

[georgekarrv]

I added #47719

[AndreyKizimenko]

QA — Verified on rc-minor-fleet-v4.89.0

Rebuilt the CVE-relevant layers of tools/fleet-docker/Dockerfile and scanned with Trivy.

Check	Without fix	With fix
libcrypto3 / libssl3	3.5.6-r0	3.5.7-r0 ✅
Trivy — CVE-2026-34182	Present	Gone ✅
Image build	✅	✅

Negative control confirms the added RUN apk --no-cache upgrade openssl libcrypto3 libssl3 line is what closes the finding — the same image without it still ships 3.5.6-r0 and flags the CVE. Fix works as intended.