Repository navigation
Vulnerability Fixes
Ram Vallamsetti edited this page Oct 15, 2026
·
2 revisions
This page records every round of vulnerability fixes for the project's container images and dependencies. Add a new round at the top of Rounds, using the same template.
What goes in each round: the scan and date, the issue and PR, and why it matters. Then the root cause, the changes, a table of findings, how the fix was verified, and the checks to run after deploy.
Status values: Fixed means the PR removes the finding. Remaining means the finding is still present, and the row says why. Accepted means the risk was acknowledged and not fixed, and the row names who accepted it.
| Date | Scanner | Image or component | Issue | PR | Result |
|---|---|---|---|---|---|
| 2026-10-14 | Amazon Inspector | ECR invdash/jobs
|
#221 | #222 | 2 CRITICAL and 17 HIGH fixed; 1 MEDIUM remains |
-
Scan: Amazon Inspector, scan at 7:52 AM PT on Oct 14, 2026. The current production tag is
f36a24f25e69ea77575e8f58aef2f6c5ed37e21d-1, and every earlier tag has the same findings. - Reported: 19 findings: 2 CRITICAL (Go stdlib CVE-2026-56857 and CVE-2026-78663) and 17 HIGH. The full ACTIVE list for the tag is in the table below. It contains 47 CVEs, including MEDIUM, LOW and untriaged ones.
- Issue: #221
-
PR: #222. It changes
infra/docker/Dockerfileonly.
invdash/jobs is the one container image behind every scheduled data job: prices, macro, the collectors (SEC, company_ir, gov-contracts and others), dashboard_build and status_feed. Each job Lambda uses this image with a different handler. A vulnerable package in this image therefore ships in every job. Inspector and Security Hub also keep raising findings and alert emails until the image is rebuilt.
-
Go findings: every Go standard library and go-chi finding is in
/usr/local/bin/aws-lambda-rie. This is the Lambda Runtime Interface Emulator that AWS bundles inpublic.ecr.aws/lambda/python:3.12-arm64. The repo contains no Go code. The newest upstream RIE (v1.37) is still built with Go 1.26.7 and chi v5.2.4. -
OS findings: the other findings are Amazon Linux 2023 packages in the base image. dnf in AL2023 is locked to the base image's release, so
dnf upgradereported "Nothing to do" until--releasever=latestwas added. - pip: the base image ships pip 25.0.1.
-
New
riebuild stage: rebuilds RIE v1.37 (commitc622c06) with Go 1.27.2, go-chi/chi/v5 v5.3.0 and golang.org/x/sys v0.44.0. It usesgolang:1.27.2-bookworm, pinned by digest, and cross-compiles for the target architecture. The result replaces the base image's binary. -
Base image pinned by digest:
public.ecr.aws/lambda/python:3.12-arm64@sha256:a10cc0fdc6ab64068a4fa069428ee8f44e8cc454c76d140c123b88207c3ebeac. -
OS and Python packages upgraded:
dnf -y --releasever=latest upgrade --refresh, then pip 26.2.1 and setuptools 84.0.0.
Before versions are from the Inspector findings on tag f36a24f…-1. After versions were checked in the locally built image with rpm -q, pip --version and trivy.
| CVE | Severity | Package | Before | Fixed version | Status |
|---|---|---|---|---|---|
| CVE-2026-56857 | CRITICAL | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-78663 | CRITICAL | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| ALAS2023-2026-3182 | HIGH | krb5-libs | 1.21.3-8.amzn2023.0.1 | 1.21.3-8.amzn2023.0.2 | Fixed in PR #222: now 1.21.3-8.amzn2023.0.2 (verified locally; pending deploy) |
| CVE-2026-56866 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-75804 | HIGH | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-78367 | HIGH | rpm / rpm-libs | 4.16.1.3-29.amzn2023.0.7 | 4.16.1.3-29.amzn2023.0.8 | Fixed in PR #222: now 4.16.1.3-29.amzn2023.0.8 (verified locally; pending deploy) |
| CVE-2026-78659 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-78660 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-78667 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-78669 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-80230 | HIGH | curl-minimal / libcurl-minimal | 8.21.0-5.amzn2023.0.1 | 8.21.0-5.amzn2023.0.2 | Fixed in PR #222: now 8.21.0-5.amzn2023.0.2 (verified locally; pending deploy) |
| CVE-2026-84233 | HIGH | rpm / rpm-libs | 4.16.1.3-29.amzn2023.0.7 | 4.16.1.3-29.amzn2023.0.8 | Fixed in PR #222: now 4.16.1.3-29.amzn2023.0.8 (verified locally; pending deploy) |
| CVE-2026-84782 | HIGH | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-89161 | HIGH | pcre2 / pcre2-syntax | 10.40-1.amzn2023.0.3 | 10.40-1.amzn2023.0.4 | Fixed in PR #222: now 10.40-1.amzn2023.0.4 (verified locally; pending deploy) |
| CVE-2026-94439 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-94440 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-97031 | HIGH | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| GHSA-9g5q-2w5x-hmxf | HIGH | github.com/go-chi/chi/v5 (aws-lambda-rie) | v5.2.4 | 5.3.0 | Fixed in PR #222: now v5.3.0 (verified locally; pending deploy) |
| GHSA-rjr7-jggh-pgcp | HIGH | github.com/go-chi/chi/v5 (aws-lambda-rie) | v5.2.4 | 5.3.0 | Fixed in PR #222: now v5.3.0 (verified locally; pending deploy) |
| CVE-2025-8869 | MEDIUM | pip | 25.0.1 | 25.3 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| CVE-2026-13346 | MEDIUM | pip | 25.0.1 | 26.2 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| CVE-2026-3219 | MEDIUM | pip | 25.0.1 | 26.1 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| CVE-2026-42772 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-54872 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-54873 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-6357 | MEDIUM | pip | 25.0.1 | 26.1 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| CVE-2026-72897 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-74860 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-75805 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-75806 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-84784 | MEDIUM | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-86138 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-86140 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-86142 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-86143 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-86144 | MEDIUM | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-8643 | MEDIUM | pip | 25.0.1 | 26.1.2 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| GHSA-3fxj-6jh8-hvhx | MEDIUM | github.com/go-chi/chi/v5 (aws-lambda-rie) | v5.2.4 | 5.3.0 | Fixed in PR #222: now v5.3.0 (verified locally; pending deploy) |
| GHSA-mqqf-5wvp-8fh8 | MEDIUM | github.com/go-chi/chi (aws-lambda-rie) | v1.5.5 | none available | Remaining: no fixed version exists. RIE still imports chi v1, and RIE never runs inside Lambda |
| CVE-2026-1703 | LOW | pip | 25.0.1 | 26.0 | Fixed in PR #222: now 26.2.1 (verified locally; pending deploy) |
| CVE-2026-35189 | LOW | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-35191 | LOW | openssl-fips-provider-latest / openssl-snapsafe-libs | 3.5.8-1.amzn2023.0.1 | 3.5.8-1.amzn2023.0.3 | Fixed in PR #222: now 3.5.8-1.amzn2023.0.3 (verified locally; pending deploy) |
| CVE-2026-39824 | LOW | golang.org/x/sys (aws-lambda-rie) | v0.21.0 | 0.44.0 | Fixed in PR #222: now v0.44.0 (verified locally; pending deploy) |
| CVE-2026-86137 | LOW | libxml2 | 2.10.4-1.amzn2023.0.20 | 2.10.4-1.amzn2023.0.21 | Fixed in PR #222: now 2.10.4-1.amzn2023.0.21 (verified locally; pending deploy) |
| CVE-2026-94448 | UNTRIAGED | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-97030 | UNTRIAGED | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
| CVE-2026-97032 | UNTRIAGED | go/stdlib (aws-lambda-rie) | 1.26.7 | 1.27.2 | Fixed in PR #222: now 1.27.2 (verified locally; pending deploy) |
Other trivy findings (not reported by Inspector): trivy also reports setuptools 70.3.0, urllib3 2.7.0 and msgpack 1.1.2 in the pip/setuptools upgrade layer, but gives no file path for them. The installed packages are urllib3 2.8.0 and setuptools 84.0.0. These are packaging-tool internals, not job dependencies. Status: Remaining. Check them again after deploy.
-
Local build:
podman build --platform linux/arm64 -f infra/docker/Dockerfile .succeeded, using QEMU emulation. -
Local scan: trivy 0.76.0 on the built image found 0 CRITICAL and 0 HIGH in OS packages and in
aws-lambda-rie. The base image before the change had 33 CRITICAL/HIGH package findings. -
Package versions: confirmed with
rpm -qinside the image (see the table). The image's Python environment importspolarsandhttpx. -
CI: the PR's
validateworkflow builds the arm64 image with buildx and runs checkov on the Dockerfile. Passed on commit0ce8dbe(Oct 14, 7:36 PM PT).
-
Merge and deploy: merge PR #222 and let Deploy production push the new image tag
<merge-sha>-1to ECR and update the job Lambdas. -
Check that the Lambdas use the new tag:
aws lambda get-function --function-name invdash-gov-contracts --query Code.ImageUri --profile invdash-admin --region us-west-1should end in the new tag. Spot-check one or two other job functions. -
Wait for the Inspector scan: Inspector scans on push, which takes a few minutes. Then list the findings:
aws inspector2 list-findings --filter-criteria '{"ecrImageRepositoryName":[{"comparison":"EQUALS","value":"invdash/jobs"}],"ecrImageTags":[{"comparison":"EQUALS","value":"<new-tag>"}],"findingStatus":[{"comparison":"EQUALS","value":"ACTIVE"}]}'Expect 0 CRITICAL and 0 HIGH. Only GHSA-mqqf-5wvp-8fh8 (chi v1, MEDIUM, no fix available) should remain. -
Check the jobs still run: the next scheduled runs should log
job_finishedwith no new failures, and theinvdash-failed-runsalarm should not change state because of the image. - Old tags: findings on old tags stay ACTIVE until those images are removed by the ECR lifecycle policy. Judge the result only by the new tag.
- Update this page: change the status column if anything differs after deploy.