Cloud Manager: Snyk Container Vulnerabilities in Selenium CI/CD Docker Image
Snyk Container scans report OS-level vulnerabilities in the Docker image used for Selenium UI tests in Adobe Experience Manager (AEM) Cloud Manager pipelines. The findings affect system packages inherited from the upstream base image and cannot be addressed through project-level Dockerfile modifications. To resolve the issue, follow Adobe Security guidance and remediation procedures.
Description description
Environment
Adobe Experience Manager (AEM) Cloud Manager (all versions)
Issue/Symptoms
A Snyk Container scan of the Docker image used for Selenium UI test execution in CI/CD pipelines reports 245 OS-level vulnerabilities in system packages inherited from the upstream base image maven:3.9.4-eclipse-temurin-21. The affected packages include:
- openssl
- curl
- glibc
- gnupg
- gnutls
- bash
- perl
These vulnerabilities are not present in application code managed by the project team and are inherited from the base image. The Dockerfile follows Cloud Manager conventions and is marked as DO NOT MODIFY, preventing direct changes to the affected packages.
The findings impact compliance and governance processes and require vendor clarification on remediation feasibility or planned fixes.
Scan tool: Snyk Container (Dockerfile)
To reproduce: Run a Snyk Container scan against the Dockerfile used in the Cloud Manager pipeline.
Root cause
The vulnerabilities are present in system packages bundled with the upstream base Docker image and are inherited by the Cloud Manager Selenium CI/CD image. Adobe relies on upstream providers to deliver base image security updates and patches.
Resolution resolution
-
Understand Image Maintenance
- The Dockerfile and associated base image used for Selenium UI testing in Cloud Manager pipelines are maintained by Adobe, but the base image (
maven:3.9.4-eclipse-temurin-21) is sourced from an upstream provider.
- The Dockerfile and associated base image used for Selenium UI testing in Cloud Manager pipelines are maintained by Adobe, but the base image (
-
Vulnerability Ownership
- OS-level vulnerabilities found in the base image are inherited from upstream dependencies and are not introduced by the project code or Adobe-specific modifications.
-
Reporting Security Issues
- To formally report or request remediation for vulnerabilities in Adobe-managed images, contact the Adobe Security team as outlined in the Adobe Security Bulletin under “How do I report a security issue in a specific Adobe product, online service or web property?”.
- Email the Security team directly at the address provided in the documentation.
-
Remediation and Updates
- Adobe periodically reviews and updates base images as upstream patches become available. If a vulnerability is patched upstream without a version change, security scanning tools may still flag the issue until the image is rebuilt and published.
- If remediation is not feasible from the project side (due to the DO NOT MODIFY policy), request formal confirmation from Adobe Security to support internal risk exception processes.
-
Internal Exception Process
- If vendor remediation is not possible, use Adobe’s formal response to proceed with your organization’s internal risk exception or compliance process.