docker-selenium/4.34.0.20250727-r1: cve remediation

[octo-sts]

docker-selenium/4.34.0.20250727-r1: fix GHSA-prj3-ccx8-p6x4

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/docker-selenium.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

📦 Build Failed: Missing Dependency

failed to parse the pom file: open pom.xml: no such file or directory

Build Details

Category	Details
Build System	melange/maven
Failure Point	maven/pombump step - attempting to parse pom.xml file

Root Cause Analysis 🔍

The pombump tool is trying to process a Maven pom.xml file that does not exist in the current directory. The docker-selenium project was checked out from git, but the build pipeline expects to find a pom.xml file at the root level for Maven dependency management. This suggests either the project structure has changed, the checkout didn't include the expected files, or the pipeline configuration is incorrect for this particular project type.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• selenium/4.28.0-r0: cve remediation #42311

Suggested Changes

File: docker-selenium.yaml

• remove at line 48 (pipeline section)
  Original:

  - uses: maven/pombump

Content:

Remove the maven/pombump step since docker-selenium uses Bazel, not Maven

Click to expand fix analysis

Analysis

The similar fix shows that the docker-selenium project uses Bazel as its build system, not Maven. The error occurs because the maven/pombump step is trying to process a non-existent pom.xml file. The fix in the past involved removing the maven/pombump step entirely and instead applying patches to handle dependency updates manually, specifically updating Netty versions in the Bazel configuration files (MODULE.bazel and maven_install.json).

Click to expand fix explanation

Explanation

The docker-selenium project uses Bazel as its build system, not Maven, so there is no pom.xml file to process. The maven/pombump step is attempting to parse a Maven configuration file that doesn't exist in this repository. By removing this step, the build will proceed without trying to process non-existent Maven files. If dependency version updates are needed, they should be handled through Bazel configuration files (MODULE.bazel) and potentially through patches, as demonstrated in the similar fix where Netty versions were updated manually.

Click to expand alternative approaches

Alternative Approaches

• Create a conditional check to only run maven/pombump if pom.xml exists, though this adds unnecessary complexity
• Replace maven/pombump with a custom script that handles Bazel dependency updates, but this would require significant additional development
• Use patches to update specific dependencies in Bazel files when needed, following the pattern shown in the similar fix

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[jamie-albert]

wolfi-dev/advisories#22832

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-r3xv-hphj-6vc6 has the latest event type of "pending-upstream-fix": https://github.com/wolfi-dev/advisories/blob/main/docker-selenium.advisories.yaml

ID:      CGA-r3xv-hphj-6vc6
Package: docker-selenium
Aliases: CVE-2025-55163 GHSA-prj3-ccx8-p6x4
Events:
  - "scan/v1" at 2025-08-14 11:49:39 UTC
  - "pending-upstream-fix" at 2025-08-15 01:25:00 UTC