fix: [CI-23214]: remediate vulnerabilities in harnesssecure/buildx#109
Draft
vinayakharness2026 wants to merge 1 commit into
Draft
Conversation
Bump base docker:dind 28.5.2 -> 29.5.3 and buildx CLI 0.23.0 -> 0.34.1 to clear the CVE backlog reported in CI-23214. Trivy delta: 626 -> 177 findings (-449 total; -14 CRITICAL, -184 HIGH). 3 new MEDIUM appear from upgraded transitive deps; no new HIGH/CRITICAL. Test image: vinayakharness/buildx-test:buildx-1.3.21--debug Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/buildx
Team: ci (Harness CI Platform)
Tickets: CI-23214
Test image:
vinayakharness/buildx-test:buildx-1.3.21--debugOnDemand scanner runs (Harness https://harness0.harness.io/):
Summary
This PR remediates
harnesssecure/buildx:1.3.20(mirrored on DockerHub asplugins/buildx:1.3.20). The base image is bumped fromdocker:28.5.2-dindtodocker:29.5.3-dindand the bundled buildx CLI fromv0.23.0tov0.34.1.Trivy delta: 626 → 177 total findings (-449). CRITICAL: 17 → 3 (-14). HIGH: 306 → 122 (-184). 3 new lower-severity CVEs introduced (all MEDIUM, no new CRITICAL/HIGH). Of the 23 headline ticket CVEs tracked: 17 resolved, 6 partial, 0 blocked.
Recommendation: REVIEW — major version bump on the docker:dind base (REVIEW requires deploy to QA / CI smoke before merge to confirm no regression in
dockerdstartup, registry/auth flows, or buildkit asset loading).CVE Delta — Trivy (local scan)
CVE Delta — Harness OnDemand (Prisma Cloud)
Baseline and after-scan executions completed (links above). Prisma Cloud per-execution findings can be viewed in the Harness UI on the linked executions. Per-execution counts are not exposed via the STO REST API filter we have available in pipeline mode (the API returns the project-wide cross-execution view), so the Trivy delta above is the authoritative numeric comparison; the OnDemand executions confirm the test image scans cleanly via the same pipeline that scans the baseline.
Per-Ticket CVE Status
CI-23214 — P2: Security Vulnerability Fixes - harnesssecure/buildx
The ticket description is a snapshot dashboard pointer (61 fixable / 95 total at snapshot). The table below tracks the highest-impact CVEs surfaced by Trivy on the live
harnesssecure/buildx:1.3.20(==plugins/buildx:1.3.20):Status legend: OK = Resolved, PARTIAL = improved but below fix threshold, BLOCKED = no upstream fix at this version yet, NEW = appeared in new version.
Changes Made
docker:28.5.2-dind→docker:29.5.3-dind; buildx CLIv0.23.0→v0.34.1arm64v8/docker:28.5.2-dind→arm64v8/docker:29.5.3-dind; buildx CLIv0.23.0→v0.34.1Version selection rationale:
docker:dindbase: chose29.5.3-dind(latest 29.x stable) because the28.xseries has no further patch beyond28.5.2, and several vulnerable bundled binaries (dockerd,containerd,runc,docker-cli) only have fixed versions in the 29.x line. The 28→29 docker daemon transition is documented backwards-compatible for the dind use-case here, but is flagged as a major bump for QA verification.docker/buildxCLI: chosev0.34.1because it is the lowest release whosego.sumsimultaneously satisfies the most-pinned ticket fix requirements:go.opentelemetry.io/otel/sdk >= v1.43.0(CVE-2026-39883),google.golang.org/grpc >= v1.79.3(CVE-2026-33186),github.com/docker/docker >= v29.3.1(CVE-2026-34040),github.com/docker/cli >= v29.2.0(CVE-2025-15558),github.com/moby/buildkit >= v0.30(CVE-2026-33747/8). v0.33.0 also carried otel/sdk v1.40 but was below v1.43; v0.34.1 was the minimum that cleared the otel/sdk-39883 bar without crossing into v0.35 (latest).Breaking-Change Warnings
Newly Introduced CVEs
Three lower-severity CVEs (all MEDIUM) appeared from upgraded transitive deps. No new HIGH or CRITICAL.
🤖 Generated by
vuln-remediationskill running in Harness CI pipeline.