[Snyk] Security upgrade maven from 3.8.5-openjdk-8 to 3.8.6-openjdk-8

[Exnadella]

User description

Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

• Dockerfile

We recommend upgrading to maven:3.8.6-openjdk-8, as this image has only 247 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Out-of-bounds Write SNYK-DEBIAN11-GLIBC-5927133	829
	Out-of-bounds Write SNYK-DEBIAN11-GLIBC-5927133	829
	CVE-2023-44487 SNYK-DEBIAN11-NGHTTP2-5953384	829
	Integer Overflow or Wraparound SNYK-DEBIAN11-GIT-3232722	714
	Integer Overflow or Wraparound SNYK-DEBIAN11-GIT-3232724	714

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

PR Type

enhancement, bug_fix

---

Description

• Upgraded the Maven base image in the Dockerfile from version 3.8.5-openjdk-8 to 3.8.6-openjdk-8.
• This upgrade addresses several security vulnerabilities, including out-of-bounds write and issues with GLIBC, NGHTTP2, and GIT.
• The update reduces the number of known vulnerabilities in the Docker image.

---

Changes walkthrough 📝

	Relevant files
Enhancement	Dockerfile Upgrade Maven version to address security vulnerabilities Dockerfile Upgraded Maven version from 3.8.5-openjdk-8 to 3.8.6-openjdk-8. Addressed multiple security vulnerabilities by updating the base image. +1/-1

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Version Compatibility Verify that the application and its dependencies are compatible with Maven 3.8.6 and no breaking changes were introduced

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Use image digest hash instead of tag for better security and build reproducibility Consider using a more specific digest hash instead of just the tag version to ensure reproducible builds and prevent potential supply chain attacks. Dockerfile [1] -FROM maven:3.8.6-openjdk-8 +FROM maven:3.8.6-openjdk-8@sha256:123abc... # Replace with actual digest Apply this suggestion Suggestion importance[1-10]: 9 Why: Using specific image digests instead of tags is a crucial security best practice that prevents supply chain attacks and ensures build reproducibility. This is particularly important for base images in production environments.	9

💡 Need additional feedback ? start a PR chat