search

docker-library / buildpack-deps

MIT License
450 stars 115 forks source link

Critical Vulnerability CVE-2022-27404 in buster #136

Closed ChristieBlanton closed 2 years ago

ChristieBlanton commented 2 years ago

The docker image for buildpack-deps:buster is flagging a critical CVE, CVE-2022-27404.

I think a rebuild should fix the issue. Screenshot 2022-09-12 112232

yosifkit commented 2 years ago

https://security-tracker.debian.org/tracker/CVE-2022-27404

The fix has only become available in Buster this weekend with the Debian 10.13 release. It (and all dependent images) will be rebuilt once the base image update is merged (https://github.com/docker-library/official-images/pull/13132).

Background:

Tags in the [official-images] library file[s] are only built through an update to that library file or as a result of its base image being updated (ie, an image FROM debian:buster would be rebuilt when debian:buster is built).

-https://github.com/docker-library/official-images/tree/2f086314307c04e1de77f0a515f20671e60d40bb#library-definition-files

Official Images FAQ:

Though not every CVE is removed from the images, we take CVEs seriously and try to ensure that images contain the most up-to-date packages available within a reasonable time frame

- https://github.com/docker-library/faq/tree/0ad5fd60288109c875a54a37f6581b2deaa836db#why-does-my-security-scanner-show-that-an-image-has-cves

Since our build system makes heavy use of Docker build cache, just rebuilding the all of the Dockerfiles won't cause any change. So we rely on periodic base image updates.

We strive to publish updated images at least monthly for Debian. We also rebuild earlier if there is a critical security need. Many Official Images are maintained by the community or their respective upstream projects, like Ubuntu, Alpine, and Oracle Linux, and are subject to their own maintenance schedule.

- from the same FAQ link