Summary
The sdc_aws_sorting_lambda container image has multiple active critical package-vulnerability findings. We need to determine which findings are introduced by the shared Lambda base image versus this repository’s Dockerfile and Python dependency installation, then apply and verify the smallest safe set of updates.
This issue tracks changes required specifically in:
swxsoc/sdc_aws_sorting_lambda- The Lambda image build and runtime layers
- Dependencies installed by
lambda_function/requirements.txt
- The downloaded AWS Lambda Runtime Interface Emulator (RIE)
Related base-image work should be tracked separately in the base-image repository and linked here.
Current implementation
The Lambda image currently:
- Uses
public.ecr.aws/w5r9l1c8/dev-swsoc-docker-lambda-base:latest
- Installs
swxsoc from the moving main branch
- Upgrades
pip and setuptools without version pins
- Installs
curl through apt
- Downloads the latest AWS Lambda RIE binary during every build
These moving inputs make the resulting image difficult to reproduce and can cause vulnerability status to change between otherwise identical builds.
Reported critical findings
The following findings were reported against the deployed image:
Investigation required
Obtain the scanner’s detailed finding export and record, for every CVE:
- Scanned image repository, tag, and digest
- Package manager/ecosystem
- Installed package version
- Fixed package version
- Package or binary filesystem path
- Image layer that introduced the package
- Scanner/vendor advisory source
- Whether the vulnerable code is present in the final runtime image
Determine whether each finding originates from:
- The shared base image
swxsoc or one of its transitive dependencies- Packages installed directly by this Dockerfile
- The AWS Lambda RIE compiled binary
- A false positive or stale image scan
Proposed remediation
Acceptance criteria
- The Lambda is built from a remediated, identifiable base-image digest.
- Runtime dependencies are reproducible enough to associate a source commit with an image digest.
- The full test suite passes.
- The new image is scanned using the same scanner/policy as the original image.
- All listed critical findings are closed or have a documented exception supported by package-path and vendor-advisory evidence.
- No unrelated application or dependency upgrades are included.
- Changes are delivered as one focused CVE-remediation commit if practical.
Verification commands
pytest --pyargs lambda_function/tests \
--cov=lambda_function/src \
--cov-report=html
cd lambda_function
docker build -t sdc_aws_sorting_lambda:cve-remediation .
Summary
The
sdc_aws_sorting_lambdacontainer image has multiple active critical package-vulnerability findings. We need to determine which findings are introduced by the shared Lambda base image versus this repository’s Dockerfile and Python dependency installation, then apply and verify the smallest safe set of updates.This issue tracks changes required specifically in:
swxsoc/sdc_aws_sorting_lambdalambda_function/requirements.txtRelated base-image work should be tracked separately in the base-image repository and linked here.
Current implementation
The Lambda image currently:
public.ecr.aws/w5r9l1c8/dev-swsoc-docker-lambda-base:latestswxsocfrom the movingmainbranchpipandsetuptoolswithout version pinscurlthroughaptThese moving inputs make the resulting image difficult to reproduce and can cause vulnerability status to change between otherwise identical builds.
Reported critical findings
The following findings were reported against the deployed image:
libssl3libexpat1libexpat1libexpat1fonttoolslibtasn1-6aiohttplibssl3libssl3Investigation required
Obtain the scanner’s detailed finding export and record, for every CVE:
Determine whether each finding originates from:
swxsocor one of its transitive dependenciesProposed remediation
aiohttp, FontTools, or Pillow are installed throughswxsocor inherited from the base image.swxsocto a release, tag, or commit rather than the movingmainbranch.Acceptance criteria
Verification commands