fix(security): upgrade Go 1.25.3, Alpine 3.21, fix CVE-2024-45337 (CR…

[vikram-avesha]

Security Vulnerability Fixes for cmd-nsmgr v1.5.8

🎯 Objective

Address all CRITICAL and HIGH severity vulnerabilities identified in Trivy security scans and DevOps audit reports for cmd-nsmgr:1.5.7.

🔍 Security Issues Resolved

Critical (1 → 0)

• ✅ CVE-2024-45337 - golang.org/x/crypto authorization bypass
  • Updated from v0.21.0/v0.22.0 → v0.36.0

High (20+ → 0)

• ✅ CVE-2024-12797, CVE-2024-6119 - OpenSSL vulnerabilities in libcrypto3/libssl3
  • Alpine upgraded from 3.20.1 → 3.21
• ✅ CVE-2024-34156, CVE-2025-47907, CVE-2025-58183, CVE-2025-58186, CVE-2025-58187, CVE-2025-58188 - Go stdlib vulnerabilities
  • Go upgraded from 1.22.5 → 1.25.3
• ✅ CVE-2025-30204 - github.com/golang-jwt/jwt/v4 memory allocation issue
  • Updated from v4.2.0 → v4.5.2
• ✅ CVE-2025-46569 - Open Policy Agent HTTP path injection
  • Updated from v0.44.0 → v1.4.0
• ✅ CVE-2025-22869 - golang.org/x/crypto/ssh DoS vulnerability
  • Fixed with crypto package update
• ✅ Dockerfile Misconfiguration - Running as root user
  • Added non-root user 'nsmgr' (UID/GID 1000)

Medium (1 remaining - no fix available)

• ⚠️ CVE-2024-28180 - gopkg.in/square/go-jose.v2 (transitive dependency, status: affected)

📦 Changes Made

Dockerfile Updates

• Base image: golang:1.22.5 → golang:1.25.3-alpine
• Runtime image: alpine:3.20.1 → alpine:3.21
• Delve debugger: v1.8.2 → v1.24.2
• grpc-health-probe: v0.4.28 → v0.4.42
• Added non-root user with proper permissions

Dependency Updates (go.mod)

• golang.org/x/crypto v0.21.0

• golang.org/x/crypto v0.36.0

• golang.org/x/net v0.23.0

• golang.org/x/net v0.38.0

• github.com/golang-jwt/jwt/v4 v4.2.0

• github.com/golang-jwt/jwt/v4 v4.5.2

• github.com/open-policy-agent/opa v0.44.0

• github.com/open-policy-agent/opa v1.4.0

• Go toolchain updated to go1.24.6## ✅ Verification

Trivy Scan Results (HIGH & CRITICAL only)

Before: