Skip to content

fix: Fix CVE-2023-44487 in mmlspark/release Docker image#2520

Merged
BrendanWalsh merged 1 commit into
masterfrom
fix-docker-image-vuln
Mar 27, 2026
Merged

fix: Fix CVE-2023-44487 in mmlspark/release Docker image#2520
BrendanWalsh merged 1 commit into
masterfrom
fix-docker-image-vuln

Conversation

@BrendanWalsh

@BrendanWalsh BrendanWalsh commented Mar 24, 2026

Copy link
Copy Markdown
Collaborator

Summary

Fixes the vulnerable org.eclipse.jetty:jetty-io package in the mcr.microsoft.com/mmlspark/release Docker image, addressing MSRC case 110886 (IcM incident 31000000570827).

Changes

Dockerfile (tools/docker/demo/Dockerfile):

  • Base image: Ubuntu 20.04 (EOL) → Ubuntu 22.04 (MCR mirror)
  • Spark: 3.5.0 → 3.5.4 (eliminates jetty-io entirely from the image)
  • PyJWT: Upgraded to ≥2.12.0 (fixes CVE-2026-32597)
  • Conda: Updated installer URL, TOS acceptance, -y flag for non-interactive builds
  • PATH: Fixed conda PATH to match install prefix (/usr/local/bin)

Pipeline (pipeline.yaml):

  • Removed build-minimal image build/push steps (unused image, broken Dockerfile, 0 active consumers)

Verification

Built and scanned locally with Trivy:

  • CVE-2023-44487 (jetty-io < 9.4.53) — resolved (jetty-io no longer present)
  • CVE-2026-32597 (PyJWT < 2.12.0) — resolved
  • ✅ Image builds and runs successfully

Context

An external researcher reported that their Jenkins compliance scan fails when building on mcr.microsoft.com/mmlspark/release due to vulnerable jetty-io versions (9.4.43 and 9.4.50). Spark 3.5.4's binary distribution no longer includes jetty JARs, fully eliminating the vulnerability.

The PublishDocker pipeline job was commented out in June 2024 (PR #2243) and has not run since. The build-minimal image used a separate broken Dockerfile that nobody maintained — removing it avoids a guaranteed build failure when re-enabling Docker publishing.

Publish Steps

After merge:

  1. Run pipeline with publishDockerImages: true (no tag) — validates auth and builds build-demo
  2. Tag release (e.g. v1.1.3) and run again — publishes mmlspark/release

Copilot AI review requested due to automatic review settings March 24, 2026 18:47
@github-actions

Copy link
Copy Markdown

Hey @BrendanWalsh 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

  • fix: Fix LightGBM crashes with empty partitions
  • feat: Make HTTP on Spark back-offs configurable
  • docs: Update Spark Serving usage
  • build: Add codecov support
  • perf: improve LightGBM memory usage
  • refactor: make python code generation rely on classes
  • style: Remove nulls from CNTKModel
  • test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

@github-actions

github-actions Bot commented Mar 24, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d9ad6a1.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the Docker build for the mcr.microsoft.com/mmlspark/release image (built from tools/docker/demo/Dockerfile) to remove vulnerable Jetty components by upgrading the base OS and Spark distribution, and to address additional Python dependency CVEs.

Changes:

  • Upgrade base image from Ubuntu 20.04 to 22.04.
  • Bump Spark from 3.5.0 to 3.5.4 (per PR description, removes Jetty JARs from the Spark distro).
  • Update Miniconda installer source/TOS handling and upgrade PyJWT to >=2.12.0.
Comments suppressed due to low confidence (1)

tools/docker/demo/Dockerfile:33

  • conda update conda is invoked without a non-interactive flag. In Docker builds this commonly prompts for confirmation and can hang/fail. Use -y/--yes (or set always_yes) to make the build deterministic.
    && conda update conda \
    && conda install -y python=3 jupyter pyspark \

Comment on lines +26 to +30
RUN curl -sSL https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh -o /tmp/miniconda.sh \
&& bash /tmp/miniconda.sh -bfp /usr/local \
&& rm -rf /tmp/miniconda.sh \
&& conda config --set auto_activate_base false \
&& conda tos accept --override-channels --channel https://repo.anaconda.com/pkgs/main \

Copilot AI Mar 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Miniconda is installed under /usr/local (-p /usr/local), but later the image sets PATH to prefer /opt/conda/bin. Since /opt/conda isn’t created here, this is confusing and makes it easier for future edits to accidentally reference a non-existent conda prefix. Consider aligning the install prefix and PATH (either install to /opt/conda or update PATH to /usr/local/bin).

This issue also appears on line 32 of the same file.

Copilot uses AI. Check for mistakes.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f304569 — changed PATH from /opt/conda/bin to /usr/local/bin to match the install prefix. Also added -y to conda update for non-interactive builds.

Comment thread tools/docker/demo/Dockerfile Outdated
@@ -1,9 +1,9 @@
FROM mcr.microsoft.com/oss/mirror/docker.io/library/ubuntu:20.04
FROM ubuntu:22.04

Copilot AI Mar 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The base image was switched from the repo’s standard MCR OSS mirror to ubuntu:22.04 from Docker Hub. This can introduce Docker Hub rate-limits/supply-chain variability and is inconsistent with the other Docker image in this repo (e.g., tools/docker/minimal/Dockerfile still uses mcr.microsoft.com/oss/mirror/...). Consider using the MCR mirror for Ubuntu 22.04 and/or pinning the image by digest for reproducible builds.

Suggested change
FROM ubuntu:22.04
FROM mcr.microsoft.com/oss/mirror/docker/library/ubuntu:22.04

Copilot uses AI. Check for mistakes.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was already addressed before the review posted — the image uses mcr.microsoft.com/mirror/docker/library/ubuntu:22.04 (MCR mirror), not Docker Hub. The suggested path mcr.microsoft.com/oss/mirror/docker/library/ doesn't carry 22.04. The tools/docker/minimal/Dockerfile still references the old oss/mirror path with 20.04 but that image hasn't been built or published in years.

@BrendanWalsh BrendanWalsh force-pushed the fix-docker-image-vuln branch 2 times, most recently from f7f6c9f to f304569 Compare March 24, 2026 23:29
@BrendanWalsh BrendanWalsh changed the title Fix CVE-2023-44487 in mmlspark/release Docker image fix: Fix CVE-2023-44487 in mmlspark/release Docker image Mar 24, 2026
@BrendanWalsh BrendanWalsh force-pushed the fix-docker-image-vuln branch 4 times, most recently from 0bf6a0d to 5ab9127 Compare March 27, 2026 03:20
@BrendanWalsh

Copy link
Copy Markdown
Collaborator Author

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@codecov-commenter

codecov-commenter commented Mar 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.91%. Comparing base (895752c) to head (5ab9127).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2520      +/-   ##
==========================================
- Coverage   84.61%   80.91%   -3.70%     
==========================================
  Files         335      335              
  Lines       17708    17708              
  Branches     1612     1612              
==========================================
- Hits        14984    14329     -655     
- Misses       2724     3379     +655     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

- Upgrade base from Ubuntu 20.04 to 22.04 (MCR mirror)
- Bump Spark from 3.5.0 to 3.5.4 (eliminates vulnerable jetty-io)
- Update conda installer URL and add TOS acceptance
- Add -y flag to conda update for non-interactive builds
- Fix PATH to match conda install prefix (/usr/local)
- Upgrade PyJWT >= 2.12.0 (CVE-2026-32597)
- Fix minimal Dockerfile with same security updates
- Restructure pipeline: build always, push only on release

Resolves IcM incident 31000000570827 / MSRC case 110886
@BrendanWalsh BrendanWalsh force-pushed the fix-docker-image-vuln branch from 5ab9127 to d9ad6a1 Compare March 27, 2026 22:50
@BrendanWalsh BrendanWalsh merged commit c8e0036 into master Mar 27, 2026
10 checks passed
@BrendanWalsh BrendanWalsh deleted the fix-docker-image-vuln branch March 27, 2026 22:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants