search

alpinelinux / docker-alpine

Official Alpine Linux Docker image. Win at minimalism!
MIT License
1.08k stars 262 forks source link

Security and License violations from Jfrog export #210

Open niranjpo opened 2 years ago

niranjpo commented 2 years ago

I am pushing my docker changes to Jfrog and exporting data for violations licenses and security. a ) From Security_Export file, I am getting following violations. ( only providing 2, but I got many more like this) Summery Component Infected Version Edited

  1. GNU Binutils od-elf32_avr.c alpine://3.14:binutils:2.35.2-r1 <= 2.35.2-r1 2021-07-19T04:34:4 8Z
    elf32_avr_get_note_section_contents() Function Section Allocation Handling Memory Exhaustion DoS

2, XZ Utils liblzma/lzma/lzma_decoder.c alpine://3.14:xz-libs:5.2.5-r0 5.2.5-r0 2021-10-16T04:34:4 6Z lzma_decode() Function Out-of-bounds Read Issue

a ) From Violations_Export file, I am getting following violations. ( only providing 2, but I got many more like this)

Summary Watch-Name Violated Resources

  1. The Apache Software License_Watch repository:cosmosdockerlocal:default License, Version 2.0 2 GNU General Public License_Watch repository:cosmosdockerlocal:default License version 3

I am not able to find any data to resolve above violations, Any help regarding the same is highly appreciated.

Thanks, Nir