fix: [CI-23227] bump Go toolchain to 1.25.11 to remediate kaniko-docker stdlib CVEs - #171
Draft
vinayakharness2026 wants to merge 1 commit into
Draft
fix: [CI-23227] bump Go toolchain to 1.25.11 to remediate kaniko-docker stdlib CVEs#171vinayakharness2026 wants to merge 1 commit into
vinayakharness2026 wants to merge 1 commit into
Conversation
…er stdlib CVEs Resolves all 20 stdlib CVEs Trivy flags in the kaniko-docker binary (CVE-2026-25679, -27139, -27142, -27145, -32280..-32283, -32288, -32289, -33811, -33814, -39820, -39823, -39825, -39826, -39836, -42499, -42504, -42507) by moving from Go 1.25.7 to 1.25.11 (the minimum-safe patch in the 1.25.x line for those CVEs). Tracks: CI-23227 Test image: vinayakharness/kaniko-test:kaniko-1.13.9--debug Trivy delta: 81 -> 61 (-20), 0 new CVEs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/kaniko
Team: ci (Harness CI Platform)
Tickets: CI-23227
Test image:
vinayakharness/kaniko-test:kaniko-1.13.9--debugOnDemand scanner runs (Harness https://harness0.harness.io/):
Summary
Upgrading the Go toolchain from 1.25.7 to 1.25.11 for drone-kaniko's binaries fully clears every stdlib CVE that Trivy flagged in our
kaniko-dockerbinary (20/20 CVEs resolved, 0 new). Trivy's overall image delta is 81 → 61 (−20) with no new CVEs introduced. The 36 vulnerabilities still present all live in the bundled binaries shipped by theharnesscommunity/kaniko-executor:1.25.15base image —executor,docker-credential-acr-env,docker-credential-ecr-login,docker-credential-gcr— and are upstream-blocked: 1.25.15 is currently the only patch version published in that repo, so they cannot be remediated from drone-kaniko alone. Recommendation: REVIEW — ship the Go bump now, track the kaniko-executor base-image bumps as a follow-up against theharnesscommunity/kaniko-executorpublisher.CVE Delta — Trivy (local scan)
Per-binary breakdown (Trivy)
kaniko/kaniko-docker(built here)kaniko/executor(base image)kaniko/docker-credential-acr-env(base image)kaniko/docker-credential-ecr-login(base image)kaniko/docker-credential-gcr(base image)CVE Delta — Harness OnDemand (Prisma Cloud)
The OnDemand scanner runs above are linked for reviewer verification. STO API counts couldn't be programmatically pulled in this run; please consult the linked executions for Prisma Cloud counts.
Per-Ticket CVE Status
CI-23227 — P2: Security Vulnerability Fixes - harnesssecure/kaniko
The ticket reports an aggregate snapshot (no specific CVE list). The remediation targets every CVE in our self-built
kaniko-dockerbinary; everything else lives in the base image.Resolved in our binary (20/20):
BLOCKED — base-image-bundled binaries from
harnesscommunity/kaniko-executor:1.25.15(cannot be fixed in drone-kaniko; need a re-published kaniko-executor):Changes Made
go.modgo 1.25.7→go 1.25.11(toolchain bump).drone.ymlgolang:1.22.4→golang:1.25.11(build image, bothdefaultandharnesspipelines).harness/harness.yamlgolang:1.25.7→golang:1.25.11(4 build steps).harness/orgs/default/projects/Drone_Plugins/pipelines/dronekanikoharness_Clone.yamlgolang:1.25.7→golang:1.25.11(2 build steps)Version selection rationale:
1.25.xline that fixes every stdlib CVE Trivy flags in ourkaniko-dockerbinary. Trivy's strictest requirement is1.25.11(CVE-2026-27145, CVE-2026-42504, CVE-2026-42507); 1.25.11 is a patch-only bump from 1.25.7 and avoids crossing into Go 1.26 unnecessarily.harnesscommunity/kaniko-executorbase image stays at1.25.15-linux-{amd64,arm64}— the latest tag the publisher has shipped. No newer tag is available on Docker Hub at the time of this PR.Newly Introduced CVEs
None. Every CVE in the after-scan was also in the baseline.
Test image
The test image
vinayakharness/kaniko-test:kaniko-1.13.9--debugwas built from this branch using the same multi-stage strategy as the production Dockerfiles (golang:1.25.11builder →harnesscommunity/kaniko-executor:1.25.15-linux-amd64runtime). The build pipeline in this repo will produce equivalent images on merge.🤖 Vuln-remediation agent — opened as DRAFT; humans review at PR time.