Feat/guacamole 1.5.3 cves patched

.github/workflows/container-build.yml

@@ -0,0 +1,51 @@
+name: Create and publish a Docker image
+
+# Configures this workflow to run every time a change is pushed to the branch called `release`.
+on:
+  push:
+    branches: ['feat/guacamole-1.5.3-cves-patched']
+  workflow_dispatch: # allow triggering github action worflows manually
+
+# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      # 
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

Dockerfile

@@ -24,8 +24,8 @@
 # Use args for Tomcat image label to allow image builder to choose alternatives
 # such as `--build-arg TOMCAT_JRE=jre8-alpine`
 #
-ARG TOMCAT_VERSION=8.5
-ARG TOMCAT_JRE=jdk8
+ARG TOMCAT_VERSION=9
+ARG TOMCAT_JRE=jdk21
 
 # Use official maven image for the build
 FROM maven:3-eclipse-temurin-8-focal AS builder
@@ -52,8 +52,8 @@ ARG MAVEN_ARGUMENTS="-DskipTests=false"
 
 # Versions of JDBC drivers to bundle within image
 ARG MSSQL_JDBC_VERSION=9.4.1
-ARG MYSQL_JDBC_VERSION=8.0.33
-ARG PGSQL_JDBC_VERSION=42.6.0
+ARG MYSQL_JDBC_VERSION=8.3.0
+ARG PGSQL_JDBC_VERSION=42.7.2
 
 # Build environment variables
 ENV \
@@ -73,6 +73,7 @@ FROM tomcat:${TOMCAT_VERSION}-${TOMCAT_JRE}
 
 # Install XMLStarlet for server.xml alterations and unzip for LOGBACK_LEVEL case
 RUN apt-get update -qq \
+    && apt-get upgrade -y \
     && apt-get install -y xmlstarlet unzip\
     && rm -rf /var/lib/apt/lists/* 
 

doc/licenses/jose4j-0.9.3/README → doc/licenses/jose4j-0.9.6/README

@@ -1,7 +1,7 @@
 jose.4.j (https://bitbucket.org/b_c/jose4j/)
 --------------------------------------------
 
-    Version: 0.9.3
+    Version: 0.9.6
     From: 'Brian Campbell' (https://bitbucket.org/b_c/)
     License(s):
         Apache v2.0

doc/licenses/jose4j-0.9.6/dep-coordinates.txt

@@ -0,0 +1 @@
+org.bitbucket.b_c:jose4j:jar:0.9.6

doc/licenses/logback-1.3.8/README → doc/licenses/logback-1.3.14/README

@@ -1,8 +1,8 @@
 Logback (http://logback.qos.ch/)
 --------------------------------
 
-    Version: 1.3.8
+    Version: 1.3.14
     From: 'QOS.ch Sàrl' (http://qos.ch/)
     License(s):
-        EPL v1.0 (bundled/logback-1.3.8/LICENSE.txt)
+        EPL v1.0 (bundled/logback-1.3.14/LICENSE.txt)
 

doc/licenses/logback-1.3.14/dep-coordinates.txt

@@ -0,0 +1,2 @@
+ch.qos.logback:logback-classic:jar:1.3.14
+ch.qos.logback:logback-core:jar:1.3.14

extensions/guacamole-auth-sso/modules/guacamole-auth-sso-openid/pom.xml

@@ -106,7 +106,7 @@
         <dependency>
             <groupId>org.bitbucket.b_c</groupId>
             <artifactId>jose4j</artifactId>
-            <version>0.9.3</version>
+            <version>0.9.6</version>
         </dependency>
 
         <!-- Guice -->

pom.xml

@@ -44,7 +44,7 @@
         <jersey.version>2.40</jersey.version>
         <junit.version>5.9.3</junit.version>
         <junit4.version>4.13.2</junit4.version>
-        <logback.version>1.3.8</logback.version>
+        <logback.version>1.3.14</logback.version>
         <slf4j.version>2.0.7</slf4j.version>
 
         <!-- The directory that should receive all generated dependency lists
@@ -116,6 +116,7 @@
                                 <exclude>**/templates/*.html</exclude>
                                 <exclude>src/licenses/**/*</exclude>
                                 <exclude>target/**/*</exclude>
+                                <exclude>.github/**/*</exclude>
                             </excludes>
                             <skip>${ignoreLicenseErrors}</skip>
                         </configuration>