search

bitnami / containers

Bitnami container images
https://bitnami.com
Other
3.41k stars 4.87k forks source link

[Postgresql] CVE found in bitnami/postgresql:15.3.0-debian-11-r0 #74006

Closed ns-pmistry closed 15 hours ago

ns-pmistry commented 2 weeks ago

Name and Version

bitnami/postgresql:15.3.0-debian-11-r0

What architecture are you using?

None

What steps will reproduce the bug?

  1. setup jfrog scan for docker
  2. run jf docker scan <>: I'm attaching the result below postgresql-15.3.0-debian-11-r0-CVE-report.txt

These issues are blocking us to deploy in fedramp environment

What is the expected behavior?

No response

What do you see instead?

CVE report attached

Additional information

No response

carrodher commented 2 weeks ago

I understand your concern about security vulnerabilities. We regularly update our images with the latest system packages; however, certain CVEs may persist until they are patched in the OS or application. Additionally, some CVEs remain unfixed due to the absence of available patches. In vulnerability scanners like Trivy, you can use the --ignore-unfixed flag to ignore such CVEs. You can learn more about our CVE policy here.

The Bitnami Application Catalog (OpenSource) is built on Debian 12 (Debian 11 was discontinued from the public catalog long time ago). Additionally, as part of VMware, Bitnami offers a custom container and Helm Charts catalog based on various base images, such as Debian 11 & 12, PhotonOS 5, Ubuntu 22.04 & 24.04, RedHat UBI 8 & 9, and custom golden images. You can explore these options through the VMware Tanzu Application Catalog.

For instance, in the case of PostgreSQL, the latest version for branch 15 is 15.8.0. This version doesn't contain fixable CVEs:

$ trivy image bitnami/postgresql:15 --scanners vuln --ignore-unfixed
2024-10-28T17:24:26+01:00   INFO    [vuln] Vulnerability scanning is enabled
2024-10-28T17:24:35+01:00   INFO    Detected OS family="debian" version="12.7"
2024-10-28T17:24:35+01:00   INFO    [debian] Detecting vulnerabilities...   os_version="12" pkg_num=115
2024-10-28T17:24:35+01:00   INFO    Number of language-specific files   num=2
2024-10-28T17:24:35+01:00   INFO    [bitnami] Detecting vulnerabilities...
2024-10-28T17:24:35+01:00   INFO    [jar] Detecting vulnerabilities...
2024-10-28T17:24:35+01:00   WARN    Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/v0.56/docs/scanner/vulnerability#severity-selection for details.

bitnami/postgresql:15 (debian 12.7)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)