JonasPammer / cookiecutter-pypackage

An awesome CookieCutter for all-the-things python.
MIT License
2 stars 1 forks source link

fix(security): fix Dockerfile CVE's #94

Closed JonasPammer closed 1 year ago

JonasPammer commented 1 year ago

As reported by reported by Run aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac in Generic CookieCutter Test job

┌───────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                            │
├───────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ setuptools (METADATA) │ CVE-2022-40897 │ HIGH     │ 63.2.0            │ 65.5.1        │ CVE-2022-40897 affecting package python-setuptools 40.2.0-6 │
│                       │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-40897                  │
├───────────────────────┼────────────────┤          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ wheel (METADATA)      │ CVE-2022-40898 │          │ 0.37.1            │ 0.38.1        │ CVE-2022-40898 affecting package python-wheel 0.33.6-7      │
│                       │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-40898                  │
└───────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
JonasPammer commented 1 year ago

note: renovate updating the base docker image (python:3.10-slim-bullseye) from 6de22c9 -> c35f011 solves the wheel CVE as seen in https://github.com/JonasPammer/cookiecutter-pypackage-test/pull/55, i.e. no manual action needed to do from cookiecutter's site other than implementing and documenting https://github.com/JonasPammer/cookiecutter-pypackage/issues/93