-
[OPIK-6944] [BE] fix(security): drop perl to clear CVE-2026-9538 in opik-backend (#7107)
frostbyte_neo 发布于
2026-06-15 14:02:07 +00:00 The opik-backend runtime image installed the full perl meta-package solely
to extract a certificate CN in install_rds_cert.sh. perl transitively pulls
in perl-Archive-Tar, which is affected by CVE-2026-9538 (ALAS2023-2026-1805,
memory exhaustion in Archive::Tar < 3.10). Amazon Linux 2023 has not yet
published a patched RPM, so a version bump cannot remediate it.Remove perl from the image and extract the cert CN with openssl + sed
instead, eliminating perl-Archive-Tar entirely. Verified against the real
108-cert AWS RDS global bundle: every CN extracts correctly.Implements OPIK-6944: JPMC - Request to resolve CVEs
Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com
下载附件