fix: Fix CVE-2023-44487 in mmlspark/release Docker image

[BrendanWalsh]

Summary

Fixes the vulnerable org.eclipse.jetty:jetty-io package in the mcr.microsoft.com/mmlspark/release Docker image, addressing MSRC case 110886 (IcM incident 31000000570827).

Changes

• Base image: Ubuntu 20.04 (EOL) → Ubuntu 22.04
• Spark: 3.5.0 → 3.5.4 (eliminates jetty-io entirely from the image)
• PyJWT: Upgraded to ≥2.12.0 (fixes CVE-2026-32597)
• Conda: Updated installer URL and TOS acceptance for compatibility

Verification

Built and scanned locally with Trivy:

• ✅ CVE-2023-44487 (jetty-io < 9.4.53) — resolved (jetty-io no longer present)
• ✅ CVE-2026-32597 (PyJWT < 2.12.0) — resolved
• ✅ Image builds and runs successfully

Context

An external researcher reported that their Jenkins compliance scan fails when building on mcr.microsoft.com/mmlspark/release due to vulnerable jetty-io versions (9.4.43 and 9.4.50). Spark 3.5.4's binary distribution no longer includes jetty JARs, fully eliminating the vulnerability.

Next Steps

After merge, the pipeline should be run with publishDockerImages: true to push the fixed image to MCR.

[github-actions]

Hey @BrendanWalsh 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA f304569.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[Copilot]

Pull request overview

Updates the Docker build for the mcr.microsoft.com/mmlspark/release image (built from tools/docker/demo/Dockerfile) to remove vulnerable Jetty components by upgrading the base OS and Spark distribution, and to address additional Python dependency CVEs.

Changes:

• Upgrade base image from Ubuntu 20.04 to 22.04.
• Bump Spark from 3.5.0 to 3.5.4 (per PR description, removes Jetty JARs from the Spark distro).
• Update Miniconda installer source/TOS handling and upgrade PyJWT to >=2.12.0.

Comments suppressed due to low confidence (1)

tools/docker/demo/Dockerfile:33

• conda update conda is invoked without a non-interactive flag. In Docker builds this commonly prompts for confirmation and can hang/fail. Use -y/--yes (or set always_yes) to make the build deterministic.

    && conda update conda \
    && conda install -y python=3 jupyter pyspark \

[Copilot]

Miniconda is installed under /usr/local (-p /usr/local), but later the image sets PATH to prefer /opt/conda/bin. Since /opt/conda isn’t created here, this is confusing and makes it easier for future edits to accidentally reference a non-existent conda prefix. Consider aligning the install prefix and PATH (either install to /opt/conda or update PATH to /usr/local/bin).

This issue also appears on line 32 of the same file.

[BrendanWalsh]

Fixed in f304569 — changed PATH from /opt/conda/bin to /usr/local/bin to match the install prefix. Also added -y to conda update for non-interactive builds.

[Copilot]

The base image was switched from the repo’s standard MCR OSS mirror to ubuntu:22.04 from Docker Hub. This can introduce Docker Hub rate-limits/supply-chain variability and is inconsistent with the other Docker image in this repo (e.g., tools/docker/minimal/Dockerfile still uses mcr.microsoft.com/oss/mirror/...). Consider using the MCR mirror for Ubuntu 22.04 and/or pinning the image by digest for reproducible builds.

Suggested change

	FROM ubuntu:22.04
	FROM mcr.microsoft.com/oss/mirror/docker/library/ubuntu:22.04

[BrendanWalsh]

This was already addressed before the review posted — the image uses mcr.microsoft.com/mirror/docker/library/ubuntu:22.04 (MCR mirror), not Docker Hub. The suggested path mcr.microsoft.com/oss/mirror/docker/library/ doesn't carry 22.04. The tools/docker/minimal/Dockerfile still references the old oss/mirror path with 20.04 but that image hasn't been built or published in years.