Bump x/net, x/crypto/, x/text, use debian:13-slim - #600
Merged
Conversation
CVE-2026-56852 (HIGH): golang.org/x/text is vulnerable to a denial of service via invalid UTF-8 input. Fixed in v0.39.0; the v0.5.4 release image ships v0.37.0. Reported by the Trivy scan of electriccoinco/lightwalletd:v0.5.4 on the zcash-stack chart's Artifact Hub security report.
CVE-2026-46600 (HIGH): golang.org/x/net/dns/dnsmessage is vulnerable to a denial of service via invalid DNS record parsing. Fixed in v0.56.0; the v0.5.4 release image ships v0.55.0. x/net v0.56.0 pulls golang.org/x/crypto to v0.53.0 and golang.org/x/sys to v0.46.0 through minimal version selection. Reported by the Trivy scan of electriccoinco/lightwalletd:v0.5.4 on the zcash-stack chart's Artifact Hub security report.
CVE-2026-56854: the source-address critical option in the Permissions returned by golang.org/x/crypto/ssh authentication callbacks is not enforced. Fixed in v0.55.0; the v0.5.4 release image ships v0.52.0. x/crypto v0.55.0 pulls golang.org/x/net to v0.57.0, golang.org/x/text to v0.41.0 and golang.org/x/sys to v0.47.0 through minimal version selection. This leaves GO-2026-5932 (golang.org/x/crypto/openpgp is unmaintained) outstanding. It has no fixed version, and lightwalletd imports neither that package nor x/crypto/ssh directly; both arrive through the gRPC dependency tree. Reported by the Trivy scan of electriccoinco/lightwalletd:v0.5.4 on the zcash-stack chart's Artifact Hub security report.
The released image was the golang:1.25 build image with the binary added to it, so the Go toolchain, binutils, perl, python3, git, curl and openssh-client all shipped to production. Those packages, not lightwalletd, accounted for essentially every finding in the v0.5.4 scan: 1890 vulnerabilities, 1142 distinct CVEs. Building in a stage and copying only the binary onto debian:13-slim drops 1059 of those distinct CVEs (1890 -> 135 findings) and takes the image from 1.9 GB to 193 MB. Nothing in the runtime image has a fix available afterwards; the remainder are unfixed Debian issues in base packages. Both CRITICALs that leave entirely: CVE-2026-43185 linux-libc-dev ksmbd signedness bug (kernel headers, present only to compile against) CVE-2026-60002 openssh-client use-after-free during host key re-exchange CVE-2026-13221, CVE-2026-42496 and CVE-2026-8376 (perl) stay, at CRITICAL: they no longer arrive via perl, libperl5.40 and perl-modules-5.40, but perl-base is part of debian:13-slim and none of the three has a fixed version. Dropping to a distroless base would clear them and take the image to 42 MB with 1 finding, at the cost of the shell and of uid 2002; that is a separate call. CGO_ENABLED=0 makes the binary static, so the runtime stage needs no toolchain libraries. ca-certificates is installed for TLS to an RPC endpoint that is not on localhost. Behaviour is unchanged: same uid 2002 lightwalletd user and home, same /var/lib/lightwalletd/db ownership, same /bin/bash for the debugging entrypoint commented out in docker-compose.yml, same entrypoint, and `lightwalletd version` still reports the git describe stamp.
y4ssi
self-requested a review
September 2, 2026 00:06
y4ssi
enabled auto-merge
September 2, 2026 00:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps dependencies to mitigate the CVEs found by the Trivy scan of
electriccoinco/lightwalletd:v0.5.4(the zcash-stack Artifact Hub security report), and uses a build stage in the Dockerfile to slim down lightwalletd's release image since it is a statically-linked golang application (it does not need things like perl installed and triggering security reports).Dependency bumps
golang.org/x/textgolang.org/x/netgolang.org/x/cryptoWhy debian-slim?
The released image was the heavy
golang:1.25build image, so the Go toolchain, binutils, perl, python3, git and openssh-client all shipped to production and accounted for most of Trivy's findings.