Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Runtime image ships BusyBox with unfixed CVE-2025-60876; consider a distroless/static base

Aperta
  • Qualcosa non va?
#4,959 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
docker, go
Ambito
infrastructure, security

Direzione di ricerca

Start by reading the Dockerfile runtime stage and checking how the image is built and tested; the issue does not name specific files or tests. Evaluate the proposed distroless base against runtime requirements such as certificates, ports, and existing shell-based workflows, then verify the resulting image no longer contains the flagged BusyBox packages and still runs the server.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

The published livekit/livekit-server image uses alpine:3.24.1 as its runtime stage, so it ships BusyBox. Container scanners flag CVE-2025-60876 (Medium, CVSS 6.5) on three packages from it:

Package Installed Fixed
busybox 1.37.0-r31 not available
busybox-binsh 1.37.0-r31 not available
ssl_client 1.37.0-r31 not available

The CVE is an HTTP request-target CR/LF injection in BusyBox wget. Alpine lists every branch (3.22, 3.23, 3.24 and edge) as "possibly vulnerable" with no fixed package (https://security.alpinelinux.org/vuln/CVE-2025-60876), so the apk upgrade --no-cache step in the Dockerfile cannot clear it, and a newer Alpine digest will not either.

livekit-server itself never invokes wget or a shell, so this is not reachable in practice. But the finding blocks security reviews for self-hosted deployments, and it will keep reappearing on every release until the runtime base changes.

Server

  • Version: v1.13.7 and v1.13.8 (same alpine:3.24.1 runtime stage)
  • Environment: self-hosted, official Docker image

To Reproduce

  1. docker pull livekit/livekit-server:v1.13.8
  2. Scan it with any image scanner (Trivy, Grype, Wiz, ...)
  3. See CVE-2025-60876 on busybox, busybox-binsh and ssl_client

Expected behavior

The image does not ship packages the server does not use. The binary is built with CGO_ENABLED=0, so it is fully static and needs only CA certificates (and optionally tzdata) at runtime.

Suggested fix

Switch the runtime stage to a distroless static base, which has no shell, package manager or BusyBox:

FROM gcr.io/distroless/static-debian12:nonroot@sha256:<digest>
COPY --from=builder /workspace/livekit-server /livekit-server
ENTRYPOINT ["/livekit-server"]
  • It includes ca-certificates, tzdata and a nonroot user (uid 65532), so outbound TLS (webhooks, Redis TLS) keeps working.
  • The apk upgrade step and its cache-busting caveat go away.
  • The :nonroot variant is fine for the default ports (7880, 7881, 3478/udp, 50000-60000/udp). Users who bind a privileged port inside the container (for example TURN/TLS on 443) would need the root variant gcr.io/distroless/static-debian12, or net.ipv4.ip_unprivileged_port_start, which may be worth a release note. Alternatively, ship :nonroot behind a separate tag.
  • Anyone relying on docker exec ... sh or a shell-based healthcheck would lose that; :debug variants of distroless exist for troubleshooting.

As a workaround today, re-basing the published image works without rebuilding:

FROM livekit/livekit-server:v1.13.8 AS upstream
FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=upstream /livekit-server /livekit-server
ENTRYPOINT ["/livekit-server"]

Additional context

The same scan of v1.13.7 also reported CVE-2026-81870 / GHSA-8wmf-6v46-5gfg (Low) on go.opentelemetry.io/otel/sdk, otlptrace and otlptracehttp at v1.44.0. That one is already resolved in v1.13.8 (otel modules at v1.46.0 via #4879), thanks! Mentioning it only so nobody re-files it.

Lingua principale
Go
Stelle
21.3k
Fork
2.4k
Merge medio
17h 59m
PR unite (30g)
74

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di livekit/livekit

Tutte le issue di livekit/livekit

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.