From 8cd188db31f37c8671143ee16e9a42d658546344 Mon Sep 17 00:00:00 2001
From: midays <midays@redhat.com>
Date: Tue, 7 Jul 2026 18:28:35 +0300
Subject: [PATCH] Fix urllib3 CVEs by upgrading to >= 2.7.0

This commit fixes the following CVEs by upgrading urllib3:
- CVE-2025-66418: Unbounded decompression chain leads to resource exhaustion
- CVE-2025-66471: Excessive resource consumption
- CVE-2026-21441: DoS via redirect response decompression
- CVE-2026-44431: Sensitive headers forwarded across origins

All four CVEs require urllib3 >= 2.7.0 to be fully resolved.

Jira tickets: MIG-1808, MIG-1809, MIG-1810, MIG-1811, MIG-1812,
MIG-1813, MIG-1814, MIG-1815, MIG-1816, MIG-1826, MIG-1827, MIG-1828,
MIG-1829, MIG-1830, MIG-1831, MIG-1832, MIG-1833, MIG-1834, MIG-1835,
MIG-1836, MIG-1837, MIG-1838, MIG-1839, MIG-1840, MIG-1841, MIG-1842,
MIG-1843, MIG-1916
---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index 1416fff..b91c988 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,6 +32,7 @@ RUN go build -o proxy ./cmd/proxy/main.go
 # Final container
 FROM registry.access.redhat.com/ubi8/ubi-minimal:latest
 RUN microdnf update -y
+RUN microdnf upgrade -y python3-urllib3 && microdnf clean all
 RUN microdnf -y install openssh-server stunnel rsync nmap && microdnf clean all
 COPY sshd_config /etc/ssh/sshd_config
 COPY stunnel.conf /etc/stunnel/stunnel.conf