Skip to content

Commit 5a2b09a

Browse files
josecelanojosecelano
committed
chore: [#433] upgrade Prometheus to v3.11.2 and document CVE analysis
1 parent 95a063f commit 5a2b09a

5 files changed

Lines changed: 91 additions & 16 deletions

File tree

‎.github/workflows/docker-security-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ jobs:
101101
timeout-minutes: 10
102102
outputs:
103103
# JSON array of Docker image references for use in scan matrix
104-
# Example: ["torrust/tracker:develop","mysql:8.4","prom/prometheus:v3.5.1","grafana/grafana:13.0.0","caddy:2.10.2"]
104+
# Example: ["torrust/tracker:develop","mysql:8.4","prom/prometheus:v3.11.2","grafana/grafana:13.0.0","caddy:2.10.2"]
105105
images: ${{ steps.extract.outputs.images }}
106106

107107
steps:

‎docs/issues/433-prometheus-cves.md‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,51 @@ After PR #436 upgraded Prometheus from `v3.5.0` to `v3.5.1`:
2727

2828
## Steps
2929

30-
- [ ] Check the latest Prometheus release:
30+
- [x] Check the latest Prometheus release:
3131
<https://hub.docker.com/r/prom/prometheus/tags>
32-
- [ ] Run Trivy against candidate newer tags:
32+
- [x] Run Trivy against candidate newer tags:
3333
`trivy image --severity HIGH,CRITICAL prom/prometheus:LATEST_TAG`
34-
- [ ] Compare results against the v3.5.1 baseline in
34+
- [x] Compare results against the v3.5.1 baseline in
3535
`docs/security/docker/scans/prometheus.md`
36-
- [ ] **If CRITICALs are cleared**: update `src/domain/prometheus/config.rs` and
36+
- [x] **If CRITICALs are cleared**: update `src/domain/prometheus/config.rs` and
3737
the CI scan matrix; update the scan doc; post results comment; close #433
3838
- [ ] **If CRITICALs remain**: post comment documenting which CVEs remain and why
3939
they cannot be fixed (upstream binary); add revisit note to #433; leave open
4040

4141
## Outcome
4242

43-
<!-- Fill in after doing the work -->
43+
- Date: 2026-04-14
44+
- Latest Prometheus tag tested: `v3.11.2` (released 2026-04-13)
45+
- Decision: **upgrade to `prom/prometheus:v3.11.2`** — all CRITICALs eliminated
46+
- Action: updated `src/domain/prometheus/config.rs`; updated scan doc; updated CI matrix comment
47+
- PR: opened against `main` on branch `433-prometheus-cves`
4448

45-
- Date:
46-
- Latest Prometheus tag tested:
47-
- Findings (HIGH / CRITICAL):
48-
- Decision: upgrade / accept risk / leave open
49-
- Comment/PR:
49+
### Scan details — `prom/prometheus:v3.11.2` (Trivy, 2026-04-14)
50+
51+
**Version comparison:**
52+
53+
| Version | HIGH | CRITICAL |
54+
| --------- | ---- | -------- |
55+
| `v3.5.0` | 16 | 4 |
56+
| `v3.5.1` | 6 | 2 |
57+
| `v3.11.2` | 4 | 0 ✅ |
58+
59+
**Target breakdown (`v3.11.2`):**
60+
61+
| Target | HIGH | CRITICAL |
62+
| ---------------- | ---- | -------- |
63+
| `bin/prometheus` | 3 | 0 |
64+
| `bin/promtool` | 1 | 0 |
65+
66+
No OS layer — pure Go binaries, no Alpine/Debian base.
67+
68+
**Remaining CVEs (all HIGH, no remote attack path):**
69+
70+
| CVE | Library | Installed | Fixed In | Notes |
71+
| -------------- | ---------------- | --------- | -------- | ----------------------------------------- |
72+
| CVE-2026-32285 | buger/jsonparser | v1.1.1 | 1.1.2 | DoS via malformed JSON; internal use only |
73+
| CVE-2026-34040 | moby/docker | v28.5.2 | 29.3.1 | Auth bypass; Docker-client code path |
74+
| CVE-2026-39883 | otel/sdk | v1.42.0 | 1.43.0 | Local PATH hijack; no remote path |
75+
76+
**Overall risk**: All 4 remaining findings are local-only. No remote attack path.
77+
Upgrade to v3.11.2 is the recommended action and was applied.

‎docs/security/docker/scans/prometheus.md‎

Lines changed: 47 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,56 @@ Security scan history for the `prom/prometheus` Docker image.
44

55
## Current Status
66

7-
| Version | HIGH | CRITICAL | Status | Last Scan | Support EOL |
8-
| ------- | ---- | -------- | ------------------------------------ | ----------- | ------------ |
9-
| v3.5.1 | 6 | 4 | ⚠️ Partial improvement after upgrade | Apr 8, 2026 | Jul 31, 2026 |
7+
| Version | HIGH | CRITICAL | Status | Last Scan | Support EOL |
8+
| ------- | ---- | -------- | ----------------------------- | ------------ | ----------- |
9+
| v3.11.2 | 4 | 0 | ✅ No CRITICALs after upgrade | Apr 14, 2026 | TBD |
1010

1111
## Scan History
1212

13+
### April 14, 2026 - Remediation Pass 2 (Issue #433)
14+
15+
**Image**: `prom/prometheus:v3.11.2`
16+
**Trivy Version**: 0.68.2
17+
**Scan Mode**: `--scanners vuln --severity HIGH,CRITICAL`
18+
**Status**: ✅ **4 vulnerabilities** (4 HIGH, 0 CRITICAL)
19+
20+
#### Summary
21+
22+
Upgraded Prometheus from `v3.5.1` to `v3.11.2` (latest as of 2026-04-13). All
23+
CRITICAL vulnerabilities eliminated. Four HIGH findings remain in upstream
24+
binary dependencies; all are local-only (no remote attack path).
25+
26+
Vulnerability comparison:
27+
28+
| Version | HIGH | CRITICAL |
29+
| ------- | ---- | -------- |
30+
| v3.5.0 | 16 | 4 |
31+
| v3.5.1 | 6 | 2 |
32+
| v3.11.2 | 4 | 0 |
33+
34+
#### Target Breakdown (`v3.11.2`)
35+
36+
| Target | HIGH | CRITICAL |
37+
| ---------------- | ---- | -------- |
38+
| `bin/prometheus` | 3 | 0 |
39+
| `bin/promtool` | 1 | 0 |
40+
41+
No OS layer — pure Go binaries, no Alpine/Debian base image.
42+
43+
#### Remaining CVEs
44+
45+
| CVE | Library | Installed | Fixed In | Severity | Notes |
46+
| -------------- | ---------------- | --------- | -------- | -------- | ----------------------------------------- |
47+
| CVE-2026-32285 | buger/jsonparser | v1.1.1 | 1.1.2 | HIGH | DoS via malformed JSON; internal use only |
48+
| CVE-2026-34040 | moby/docker | v28.5.2 | 29.3.1 | HIGH | Auth bypass; Docker-client code path |
49+
| CVE-2026-39883 | otel/sdk | v1.42.0 | 1.43.0 | HIGH | Local PATH hijack; no remote path |
50+
51+
All remaining findings are in upstream Prometheus binary dependencies. No
52+
remote attack path exists for any of the three CVE types, and fixes are
53+
pending upstream Prometheus releases.
54+
55+
---
56+
1357
### April 8, 2026 - Remediation Pass 1 (Issue #428)
1458

1559
**Image**: `prom/prometheus:v3.5.1`

‎project-words.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ bootcmd
164164
browsable
165165
btih
166166
btrfs
167+
buger
167168
buildx
168169
cdmon
169170
celano
@@ -199,6 +200,7 @@ crontabs
199200
cursorignore
200201
custompass
201202
customuser
203+
cves
202204
cyberneering
203205
dcron
204206
dearmor
@@ -280,6 +282,7 @@ josecelano
280282
journalctl
281283
jsonlint
282284
jsonls
285+
jsonparser
283286
keepalive
284287
keygen
285288
keypair

‎src/domain/prometheus/config.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ const DEFAULT_SCRAPE_INTERVAL_SECS: u32 = 15;
2121
pub const PROMETHEUS_DOCKER_IMAGE_REPOSITORY: &str = "prom/prometheus";
2222

2323
/// Docker image tag for the Prometheus container
24-
pub const PROMETHEUS_DOCKER_IMAGE_TAG: &str = "v3.5.1";
24+
pub const PROMETHEUS_DOCKER_IMAGE_TAG: &str = "v3.11.2";
2525

2626
/// Prometheus metrics collection configuration
2727
///
@@ -95,7 +95,7 @@ impl PrometheusConfig {
9595
/// use torrust_tracker_deployer_lib::domain::prometheus::PrometheusConfig;
9696
///
9797
/// let image = PrometheusConfig::docker_image();
98-
/// assert_eq!(image.full_reference(), "prom/prometheus:v3.5.1");
98+
/// assert_eq!(image.full_reference(), "prom/prometheus:v3.11.2");
9999
/// ```
100100
#[must_use]
101101
pub fn docker_image() -> DockerImage {

0 commit comments

Comments
 (0)