From aa8c3e1ec8b211a79905575f40a83f4ca4ad2294 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Wed, 12 Aug 2026 16:06:00 +0200 Subject: [PATCH 1/2] ROX-36081: remove curl, vim, python3 from scanner-db image Expand rpm -e glob patterns to match curl-minimal/libcurl-minimal, vim-minimal, and python3 packages that are not needed at runtime and carry HIGH CVEs flagged in GovCloud compliance scans. Mirrors the fix applied to central-db and scanner-v4-db in stackrox/stackrox#22269. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 --- image/db/rhel/konflux.Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index f7a6cbba3..b2b464641 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -37,7 +37,7 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \ chown -R postgres:postgres /var/lib/postgresql && \ chown -R postgres:postgres /var/run/postgresql && \ dnf clean all && \ - rpm --verbose -e --nodeps $(rpm -qa curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm --verbose -e --nodeps $(rpm -qa 'curl*' 'libcurl*' 'vim*' 'python3*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum && \ mkdir /docker-entrypoint-initdb.d From 42c1dac7a6a63fa3a9b429a7891727ec701a6c86 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Thu, 13 Aug 2026 15:03:26 +0200 Subject: [PATCH 2/2] ROX-36081: fix scanner-db package removal pattern Remove python3 from removal list (needed by postgresql-upgrade). Add libcurl and vim to removal list (carry unfixable CVEs). Use glob pattern 'curl*' to match curl-minimal. Add comments explaining removal rationale. Partially generated by AI. Co-Authored-By: Claude Opus 4.6 --- image/db/rhel/Dockerfile | 7 +++++-- image/db/rhel/Dockerfile.slim | 7 +++++-- image/db/rhel/konflux.Dockerfile | 6 +++++- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/image/db/rhel/Dockerfile b/image/db/rhel/Dockerfile index bffbfc43f..5d698f3b0 100644 --- a/image/db/rhel/Dockerfile +++ b/image/db/rhel/Dockerfile @@ -69,8 +69,11 @@ RUN microdnf upgrade -y --nobest && \ # https://access.redhat.com/solutions/5616681 microdnf reinstall -y tzdata && \ microdnf clean all && \ - # (Optional) Remove line below to keep package management utilities - rpm -e --nodeps $(rpm -qa shadow-utils curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm -e --nodeps $(rpm -qa shadow-utils \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \ localedef -f UTF-8 -i en_US en_US.UTF-8 && \ mkdir /docker-entrypoint-initdb.d diff --git a/image/db/rhel/Dockerfile.slim b/image/db/rhel/Dockerfile.slim index 8e3bb7d34..08c67ce49 100644 --- a/image/db/rhel/Dockerfile.slim +++ b/image/db/rhel/Dockerfile.slim @@ -69,8 +69,11 @@ RUN microdnf upgrade -y --nobest && \ # https://access.redhat.com/solutions/5616681 microdnf reinstall -y tzdata && \ microdnf clean all && \ - # (Optional) Remove line below to keep package management utilities - rpm -e --nodeps $(rpm -qa shadow-utils curl '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm -e --nodeps $(rpm -qa shadow-utils \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum /tmp/postgres-libs.rpm /tmp/postgres-server.rpm /tmp/postgres.rpm /tmp/postgres-contrib.rpm && \ localedef -f UTF-8 -i en_US en_US.UTF-8 && \ mkdir /docker-entrypoint-initdb.d diff --git a/image/db/rhel/konflux.Dockerfile b/image/db/rhel/konflux.Dockerfile index b2b464641..cd9186904 100644 --- a/image/db/rhel/konflux.Dockerfile +++ b/image/db/rhel/konflux.Dockerfile @@ -37,7 +37,11 @@ RUN localedef -f UTF-8 -i en_US en_US.UTF-8 && \ chown -R postgres:postgres /var/lib/postgresql && \ chown -R postgres:postgres /var/run/postgresql && \ dnf clean all && \ - rpm --verbose -e --nodeps $(rpm -qa 'curl*' 'libcurl*' 'vim*' 'python3*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ + rpm --verbose -e --nodeps $(rpm -qa \ + # Not needed by postgres, carry unfixable CVEs + 'libcurl*' 'vim*' \ + # Flagged by "Curl in Image" and "Red Hat Package Manager in Image" default policies + 'curl*' '*rpm*' '*dnf*' '*libsolv*' '*hawkey*' 'yum*') && \ rm -rf /var/cache/dnf /var/cache/yum && \ mkdir /docker-entrypoint-initdb.d