CVE fixes - 2026-09-23 (ruby resolv via Ruby 3.4.11)

[jenkins-cicd-bot]

Fixable in taurus, this run: 11 detected → 2 fixed.

Baseline: prisma-cloud-ondemand-scan #262 on blazemeter/taurus:unstable (Image ID sha256:222c456e…, confirmed equal to the registry's live config digest, so this is not a stale-image read).

Jira: none — the Atlassian MCP is not available in this headless/cron run, so no ticket could be created. A MOB Story should be created manually and linked here.

Fixed (verified gone in the branch image)

CVE	Severity	CVSS	Package	Old → New
CVE-2026-80212	high	7.5	ruby resolv (default gem)	0.7.1 → 0.7.2
CVE-2026-80213	medium	4.0	ruby resolv (default gem)	0.7.1 → 0.7.2

Both come from one change: ARG RUBY_VERSION 3.4.10 → 3.4.11.

Ruby 3.4.11 bundles resolv 0.7.2 as a default gem. That matters because Prisma reads the version from specifications/default/resolv-<v>.gemspec, and a gem install never replaces that file — so bumping Ruby is the only real fix for a default gem. The alternative (deleting the stale gemspec) is the scanner-appeasement bug recorded in vulnerability_history.md: it silences Prisma while require silently falls back to the vulnerable stdlib copy.

This also let the now-redundant gem install resolv -v 0.7.2 line go; its recorded removal condition is now met.

Verified before opening, in both directions, against stock ruby: images: the build-time assertion passes on 3.4.11 (resolv=0.7.2 via Gem.loaded_specs) and aborts with resolv loaded 0.7.1 on 3.4.10 — so the assertion is not vacuous.

json stays force-installed: Ruby 3.4.11 still ships json 2.9.1.

Verification

Verified against the taurus-branch-builder image scan (build #597) before opening — integration passed.

Per-CVE diff of baseline vs branch scan: exactly the 2 targeted CVEs removed, and zero new CVEs introduced. (xorg-server CVE-2023-5574 appears in both directions only because apt resolved 2:21.1.12-1ubuntu1.6 → 1ubuntu1.8 in the fresh build; same CVE, still flagged — net zero, not a regression.)

Raw scan, for reconciliation only: baseline 343 rows → branch 341 [crit 6→6, high 56→55, medium 224→223, low 50→50, negligible 7→7]; distinct CVEs 316 → 314. X/Y count distinct CVEs while the raw total counts per-occurrence, so these do not sum arithmetically.

Local code review (pre-push)

superpowers:requesting-code-review was not available in this session, so the /code-review fallback ran (4 independent angles). Two findings accepted and amended into the commit before push:

• Applied — reconcile vulnerability_history.md. It still stated in bold that ruby-build offered no 3.4.11 and showed ARG RUBY_VERSION=3.4.10 + gem install resolv as the authoritative "don't re-derive" recipe. Left unfixed, the next CVE run would have re-added the line this PR deletes. The doc now also records how to confirm a default-gem bump cheaply (check Gem.default_specifications_dir, dry-run the assertion in a stock container) before spending a 40-minute branch build.

• Applied — drop a Resolv::VERSION fallback arm I had added to the assertion. Gem.loaded_specs["resolv"] is populated, so it was dead code; and had it ever fired it would have asserted stdlib file contents rather than gem activation — weaker than, and contrary to, the property that assertion exists to prove.

• Kept as-is — the assertion's exact == version comparison (a future Ruby bundling resolv 0.8.0 would abort with a misleading message). Real, but pre-existing for all four gems, out of scope for a CVE fix, and it fails closed with a readable message.

Also fixed: two comment inaccuracies (resolv never had a "purge", only a force-install; and a duplicated json removal-condition sentence).

Not actionable in this repo — 305 CVEs (count only)

Monitor-only JMeter/Gatling bundled jars 105, no released patch (needed/deferred/open) 126, Ubuntu Pro ESM 71, distro pip apt cannot reach 2, k6 binary internals 1. No scanner-appeasement/Roslyn and no JDK-later-major findings this run.

Criticals this run: all 3 distinct critical CVEs (6 rows) are monitor-only JMeter/Gatling bundled jars — Tika CVE-2025-66516 / CVE-2025-54988 and netty-handler CVE-2026-75595. Computed from the scan, not assumed.

Worth flagging: every one of the 71 OS findings that has a fix is Ubuntu Pro ESM (+esmN/~esmN — ffmpeg, gnuplot, openexr, qtbase, fonttools, srt, gst-plugins-bad, apt pip). apt-get cannot reach any of them, which is also why no finding was rebuild-clearable this run (R = 0) despite 198 OS rows.

Fixable but did not land (9)

All are standing deferrals, each re-checked against upstream this run; none became actionable:

• @faker-js/faker 5.5.3, file-type 3.9.0 — postman-collection 5.3.1 (latest) still pins both at exact old versions.
• csv-parse 4.16.3 — newman latest is still 6.2.2; also a version-match false positive (the vulnerable option pair does not exist in 4.x).
• diff 7.0.0 (mocha) — only mocha 12 moves to diff ^9; mocha 11.8.0 still ^7. A major runner bump for one CVSS-2.7 low.
• undici 6.28.0 ×3 (npm-internal) — npm 11.20.0 (new, published 2026-09-22) and 12.1.0 both still bundle 6.28.0, so npm i -g npm@11 cannot clear these. Still monitor.
• setuptools CVE-2026-59890 — needs 83.0.0, but setup.py still imports pkg_resources, removed in 82.0.0.
• ruby json 2.9.1 — Ruby 3.4.11 still ships 2.9.1; loaded code is patched (2.19.9), the stale default gemspec is the honest, visible residue.

No CVEs require manual Dockerfile intervention this run.

🤖 Generated with Claude Code