Skip to content

fix: upgrade packages in agent container to mitigate CVE-2023-44487 #760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mossaka merged 1 commit into from
Feb 12, 2026
Merged

fix: upgrade packages in agent container to mitigate CVE-2023-44487 #760

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions containers/agent/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ RUN set -eux; \
fi && \
rm -rf /var/lib/apt/lists/*

# Upgrade all packages to pick up security patches
# Addresses CVE-2023-44487 (HTTP/2 Rapid Reset) and other known vulnerabilities
RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
Comment on lines +36 to +38

Copilot AI Feb 12, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Dockerfile.minimal (used for chroot mode) should also receive the same apt-get upgrade step for consistency. While chroot mode relies more on host binaries, the minimal image still includes iptables, iproute2, and git packages that could have security vulnerabilities. Consider adding the same upgrade step after the package installation in Dockerfile.minimal (after line 19).

This issue also appears in the following locations of the same file:

  • line 36
  • line 38

Copilot uses AI. Check for mistakes.

# Create non-root user with UID/GID matching host user
# This allows the user command to run with appropriate permissions
# and prevents file ownership issues with mounted volumes
Expand Down
Loading