Container Image With a Critical CVE at Release
A release candidate image scans with one critical vulnerability in a widely used compression library. The service processes uploaded archives, so the vulnerable code path is reachable. The fix requires upgrading a base image, which changes the OS version and requires a full regression run. The release is tied to a contractual deadline in three days, and the team estimates the regression run takes two days with a 20% chance of finding a blocking issue. The image currently runs as root and has a writable filesystem. The deployment platform supports network policies and read-only root filesystems but they are not enabled. The security team must decide whether to ship, delay, or ship with compensating controls.
1. Recommend a decision and justify it using risk reasoning.
Read the worked answer
The vulnerability is critical and reachable because the service processes uploaded archives, so the risk is not theoretical. Shipping as-is is hard to justify. A defensible path is to ship only with compensating controls that reduce exploitability: run the container as non-root, enable a read-only root filesystem, apply a network policy restricting egress, and add input size and type limits on archive processing. These reduce impact but do not remove the vulnerability. In parallel, start the base-image upgrade and regression run immediately. If regression passes, deploy the fixed image within the window. If it fails, escalate the deadline with documented risk acceptance signed by the accountable owner. The decision should be recorded with residual risk and a remediation date.
2. What should be verified before relying on the compensating controls?
Read the worked answer
Verify that the service actually runs as non-root and that file writes needed for operation go to a mounted volume, not the root filesystem. Confirm the read-only root filesystem does not break temp-file handling for archive extraction; if it does, mount a scoped tmpfs. Test the network policy to ensure only required egress is allowed and that it does not silently break dependencies. Confirm archive size and type limits are enforced server-side and cannot be bypassed by chunked uploads or nested archives. Finally, confirm monitoring detects exploitation attempts. Controls that are configured but untested are not controls.