Update Dockerfile to fix CVEs: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61729, CVE-2025-61727 #1357
Description
Description
The main Dockerfile currently uses golang:1.25-alpine3.21 as the base image in the official build (Dockerfile, line 1), which contains Go 1.25.4. This version has several known CVEs that need to be addressed:
Impact
These CVEs affect:
- Docker images built from the current Dockerfile
- Any containerized deployments using the official image
- Database connections using TLS/SSL certificates
- Certificate validation in PKI environments
- Applications relying on mutual TLS authentication
- CVE-2025-61729 (GHSA-7c64-f9jr-v9h2) can lead to Denial of Service (DoS) through resource exhaustion when processing malicious certificates with excessive hostname configurations.
- CVE-2025-61727 (GHSA-5mh9-3jwc-rp59) allows bypassing excluded subdomain constraints using wildcard SANs, allowing unauthorized certificate usage (e.g., exclusion for test.example.com does not prevent *.example.com SAN).
Proposed Fix
Update the main Dockerfile to use Go 1.25.5 or later, which includes fixes for these CVEs.
Current (Go 1.25.4):
FROM golang:1.25-alpine3.21 AS builder
Proposed (Go 1.25.7):
FROM 1.25.7-alpine3.22 AS builder
Vulnerability Details
- CVE-2025-61729 - GHSA-7c64-f9jr-v9h2 (High, CVSS: 7.5)
- Affected Package: crypto/x509
- CWE: CWE-770 (Resource Allocation Without Limits)
- Ref: crypto/x509: excessive resource consumption in printing error string for host certificate validation (CVE-2025-61729) golang/go#76445
- CVE-2025-61727 - GHSA-5mh9-3jwc-rp59 (Medium, CVSS: 6.5)
- Affected Package: crypto/x509
- CWE: CWE-295 (Improper Certificate Validation)
- Ref: crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (CVE-2025-61727) golang/go#76442
- CVE-2025-68121 - NVD
- CVE-2025-61726 - NVD
- CVE-2025-61728 - NVD
- CVE-2025-61730 - NVD
References
Additional Context
All vulnerabilities were fixed in Go 1.25.7 (released December 2, 2025). The update is a simple version bump with no breaking changes expected. Given that golang-migrate often handles database connections with TLS/SSL, addressing these certificate validation vulnerabilities is important for secure deployments.