docker-selenium/4.35.0.20250808-r2: cve remediation

[octo-sts]

docker-selenium/4.35.0.20250808-r2: fix GHSA-3p8m-j85q-pgmj

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/docker-selenium.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

📦 Build Failed: Missing Dependency

failed to parse the pom file: open pom.xml: no such file or directory

Build Details

Category	Details
Build System	melange/maven
Failure Point	maven/pombump step - pombump pom.xml command

Root Cause Analysis 🔍

The pombump tool is trying to process a Maven pom.xml file that doesn't exist in the project root directory. This is a docker-selenium project which may not be a Maven-based Java project, or the pom.xml file may be located in a different directory than expected by the build pipeline.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• selenium/4.28.0-r0: cve remediation #42311

Suggested Changes

File: docker-selenium.yaml

• removal at line 67 (pipeline section)
  Original:

  - uses: maven/pombump

Content:

Remove the maven/pombump step completely as docker-selenium uses Bazel, not Maven

Click to expand fix analysis

Analysis

Based on the similar fixed build failure, the pattern is clear: the docker-selenium project uses Bazel as its build system, not Maven. The fix involved removing the maven/pombump step entirely since there is no pom.xml file in the docker-selenium repository. The project uses Bazel for dependency management and builds, making Maven-specific steps incompatible.

Click to expand fix explanation

Explanation

The docker-selenium project uses Bazel as its build system, not Maven. This is evident from the similar fix where the selenium project had the same issue - it was trying to use maven/pombump on a project that doesn't have a pom.xml file because it uses Bazel instead of Maven. The maven/pombump step is designed to update Maven pom.xml files, but since docker-selenium doesn't use Maven for its build system, this step is unnecessary and causes the build to fail when it tries to find a non-existent pom.xml file. Removing this step will allow the build to proceed with the correct Bazel-based build process.

Click to expand alternative approaches

Alternative Approaches

• Check if the project has switched to Maven in newer versions and add pom.xml generation if needed
• Use a conditional check to only run maven/pombump if pom.xml exists
• Replace maven/pombump with a Bazel-specific dependency update mechanism if available

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[dnegreira]

Fixed via #65416

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-343x-pv45-x36w has the latest event type of "fixed": https://github.com/wolfi-dev/advisories/blob/main/docker-selenium.advisories.yaml

ID:      CGA-343x-pv45-x36w
Package: docker-selenium
Aliases: CVE-2025-58057 GHSA-3p8m-j85q-pgmj
Events:
  - "scan/v1" at 2025-09-04 07:31:43 UTC
  - "fixed" at 2025-09-10 10:04:01 UTC