Skip to content

fix(docker): bump runtime git apk to 2.54.0-r0 for CVE-2026-32631 - #486

Merged
Jan-Kazlouski-elastic merged 3 commits into
mainfrom
jan-kazlouski/13623-cve-2026-32631-fix
Aug 28, 2026
Merged

fix(docker): bump runtime git apk to 2.54.0-r0 for CVE-2026-32631#486
Jan-Kazlouski-elastic merged 3 commits into
mainfrom
jan-kazlouski/13623-cve-2026-32631-fix

Conversation

@Jan-Kazlouski-elastic

@Jan-Kazlouski-elastic Jan-Kazlouski-elastic commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Part of https://github.com/elastic/security/issues/13623

Bump Wolfi runtime git apk pin from 2.50.1-r1 to 2.54.0-r0 to resolve CVE-2026-32631 (information exposure in git).

Scanner A/B (CVE-2026-32631)

Baseline: git 2.50.1-r1 → 2.54.0-r0 (Wolfi apk runtime dependency).

Method: Trivy OS package scan on docker.elastic.co/integrations/crawler:1.0.0-SNAPSHOT (before) vs Wolfi base image with git=~2.54.0-r0 installed (after — simulates post-merge Dockerfile.wolfi pin).

CVE Severity Issue Before After
CVE-2026-32631 Low #13623 reported (git@2.50.1-r1) clear (git@2.54.0-r0)

1/1 CVE: reported → clear. Container re-publish + snyk container monitor still needed for dashboard refresh.

Checklists

Pre-Review Checklist

  • This PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check crawler.yml.example and elasticsearch.yml.example)
  • This PR has a meaningful title
  • This PR links to all relevant GitHub issues that it fixes or partially addresses
  • this PR has a thorough description
  • Covered the changes with automated tests
  • Tested the changes locally (make install-gems, make lint, make test — 690 examples, 0 failures)
  • Added a label for each target release version (example: v0.1.0)
  • Considered corresponding documentation changes
  • Contributed any configuration settings changes to the configuration reference
  • Ran make notice if any dependencies have been added

Changes Requiring Extra Attention

  • Security-related changes (encryption, TLS, SSRF, etc)

Related Pull Requests

N/A

Release Note

Bump Wolfi runtime git apk to 2.54.0-r0 to fix CVE-2026-32631 (information exposure).

@Jan-Kazlouski-elastic
fix(docker): bump runtime git apk to 2.54.0-r0 for CVE-2026-32631
59d80ed 
Resolves information exposure in git 2.50.1-r1 (Wolfi runtime dependency).

Part of elastic/security#13623
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic requested a review from a team as a code owner August 26, 2026 11:14
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic enabled auto-merge (squash) August 28, 2026 08:42
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic merged commit 8f068c6 into main Aug 28, 2026
2 checks passed
@Jan-Kazlouski-elastic
Jan-Kazlouski-elastic deleted the jan-kazlouski/13623-cve-2026-32631-fix branch August 28, 2026 08:55
@github-actions github-actions Bot mentioned this pull request Aug 28, 2026
Merged
Jan-Kazlouski-elastic added a commit that referenced this pull request Aug 28, 2026
@github-actions @Jan-Kazlouski-elastic
[1.0] fix(docker): bump runtime git apk to 2.54.0-r0 for CVE-2026-326…
b5024fe 
…31 (#486) (#488)

Backports the following commits to 1.0:
- fix(docker): bump runtime git apk to 2.54.0-r0 for CVE-2026-32631
(#486)

Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@erikcurrin-elastic erikcurrin-elastic erikcurrin-elastic approved these changes

Assignees

No one assigned

Labels

auto-backport release_note team:extract-and-transform v1.0.1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Jan-Kazlouski-elastic @erikcurrin-elastic