There was another thread for this, but we haven't heard back in a month, so creating a new ticket.
When using Lambda/Python3.9 as a base image for ECR images, vulnerabilities have been discovered by ECR image scans stating:
There are vulnerabilities present in the base image for Lambda/Python3.9 ECR images. The vulnerabilities are displayed in the ECR image scans, below is an example of these vulnerabilities.
"
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: https://github.com/advisories/GHSA-f92h-rw3f-8j92: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999. NOTE: https://sqlite.org/forum/forumpost/5bcbf4571c NOTE: Fixed by: https://sqlite.org/src/info/0e4e7a05c4204b47
"
However, permissions are set to not allow yum updates/installs.
My team has tried reaching out and working with AWS to try different resolutions, but none were able to fix the image vulnerabilities. It looks like these issues are related to the base image and we are unable to patch them from our end. I kindly request someone to take a look into this.
There was another thread for this, but we haven't heard back in a month, so creating a new ticket.
When using Lambda/Python3.9 as a base image for ECR images, vulnerabilities have been discovered by ECR image scans stating:
There are vulnerabilities present in the base image for Lambda/Python3.9 ECR images. The vulnerabilities are displayed in the ECR image scans, below is an example of these vulnerabilities.
" Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: https://github.com/advisories/GHSA-f92h-rw3f-8j92: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999. NOTE: https://sqlite.org/forum/forumpost/5bcbf4571c NOTE: Fixed by: https://sqlite.org/src/info/0e4e7a05c4204b47 "
The recommended fix is to run: "yum update nss": https://alas.aws.amazon.com/AL2/ALAS-2024-2442.html
However, permissions are set to not allow yum updates/installs.
My team has tried reaching out and working with AWS to try different resolutions, but none were able to fix the image vulnerabilities. It looks like these issues are related to the base image and we are unable to patch them from our end. I kindly request someone to take a look into this.