search

JonasAlfredsson / docker-nginx-certbot

Automatically create and renew website certificates for free using the Let's Encrypt certificate authority.
https://hub.docker.com/r/jonasal/nginx-certbot
MIT License
942 stars 167 forks source link

Medium CVEs present on latest image CVE-2023-42363/6 #269

Closed jracabado closed 2 months ago

jracabado commented 3 months ago

Hi,

Our scanner alerted us to the BusyBox CVEs being present on the latest version of image jonasal/nginx-certbot image.

The CVEs are:

Rebuilding should fix these as a the latest Nginx image includes a patched version of Alpine v3.19.

Allow me to thank you in advance for keeping this project updated and I hope these issues help with that.

JonasAlfredsson commented 3 months ago

Do I read these CVEs right that they are for awk? I don't think we use awk at all, so it shouldn't really matter, but I will rebuild stuff either way since it is easy from my side.

jracabado commented 2 months ago

@JonasAlfredsson that's correct. These were still classified as Medium vulnerabilities. Thanks for the rebuild, these now appear as solved in the vulnerability scanners.