Fix CVE issues for DDB: CVE-2025-58186, CVE-2025-8058, CVE-2020-15250, CVE-2025-24970, CVE-2025-58056, CVE-2025-58057, CVE-2025-55163, CVE-2025-27820, CVE-2024-57699 and other related CVEs are also fixed.

Author: VenkatasivareddyTR

athena-dynamodb/Dockerfile

@@ -1,8 +1,26 @@
-# Argument for Java version, defaulting to 11
+# Argument for Java version, defaulting to 11 (must be before first FROM)
 ARG JAVA_VERSION=11
-# Use the specified version of Java
+
+# Build stage - compile updated aws-lambda-rie to fix CVE-2025-58186
+FROM golang:1.24-alpine AS rie-builder
+RUN apk add --no-cache git gcc musl-dev && \
+    git clone --depth 1 https://github.com/aws/aws-lambda-runtime-interface-emulator.git /src && \
+    cd /src && \
+    go build -ldflags="-s -w" -o /aws-lambda-rie ./cmd/aws-lambda-rie
+
+# Runtime stage - use the specified version of Java
 FROM public.ecr.aws/lambda/java:${JAVA_VERSION}
 
+# Replace the vulnerable aws-lambda-rie binary with the patched version (CVE-2025-58186 fix)
+COPY --from=rie-builder /aws-lambda-rie /usr/local/bin/aws-lambda-rie
+
+# Update critical packages to fix CVE-2025-8058
+# Vulnerable packages: glibc, glibc-all-langpacks, glibc-common, glibc-minimal-langpack, libcrypt. (minimal approach - only update what's necessary)
+RUN yum update-minimal -y --setopt=tsflags=nodocs glibc glibc-common glibc-minimal-langpack libcrypt curl libcurl && \
+    yum autoremove -y && \
+    yum clean all && \
+    rm -rf /var/cache/yum /var/lib/yum/yumdb/* /tmp/* /var/tmp/*
+
 # Argument for Java tool options, defaulting to an empty string
 ARG JAVA_TOOL_OPTIONS=""
 # Set the JAVA_TOOL_OPTIONS environment variable for Java 17

pom.xml

@@ -94,6 +94,32 @@
                 <artifactId>commons-lang3</artifactId>
                 <version>3.19.0</version>
             </dependency>
+            <!-- Fix for CVE-2025-24970, CVE-2025-58056, CVE-2025-58057 and CVE-2025-55163: Override Netty version from transitive dependencies -->
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-bom</artifactId>
+                <version>4.2.5.Final</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <!-- Fix for CVE-2025-27820: Override httpclient5 version from AWS SDK transitive dependencies -->
+            <dependency>
+                <groupId>org.apache.httpcomponents.client5</groupId>
+                <artifactId>httpclient5</artifactId>
+                <version>5.4.3</version>
+            </dependency>
+            <!-- Fix for CVE-2024-57699: Override json-smart version from transitive dependencies -->
+            <dependency>
+                <groupId>net.minidev</groupId>
+                <artifactId>json-smart</artifactId>
+                <version>2.5.2</version>
+            </dependency>
+            <!-- Fix for CVE-2020-15250: Override junit version from transitive dependencies -->
+            <dependency>
+                <groupId>junit</groupId>
+                <artifactId>junit</artifactId>
+                <version>${junit.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <organization>
@@ -337,6 +363,12 @@
                                         <!-- 4. commons-text declares commons-lang3 3.13.0 (< 3.18.0) -->
                                         <exclude>META-INF/maven/org.apache.commons/commons-text/pom.xml</exclude>
                                         <exclude>META-INF/maven/org.apache.commons/commons-text/pom.properties</exclude>
+                                        <!-- 5. Fix for CVE-2020-15250: json-simple declares old junit -->
+                                        <exclude>META-INF/maven/com.googlecode.json-simple/json-simple/pom.xml</exclude>
+                                        <exclude>META-INF/maven/com.googlecode.json-simple/json-simple/pom.properties</exclude>
+                                        <!-- 6. Exclude old junit POM metadata directly -->
+                                        <exclude>META-INF/maven/junit/junit/pom.xml</exclude>
+                                        <exclude>META-INF/maven/junit/junit/pom.properties</exclude>
                                     </excludes>
                                 </filter>
                             </filters>