search

docker-library / golang

Docker Official Image packaging for golang
https://golang.org
BSD 3-Clause "New" or "Revised" License
1.48k stars 510 forks source link

cwe vulnerabilities golang:1.21.5-alpine3.18 -19 #501

Closed Mari0Strife closed 9 months ago

Mari0Strife commented 9 months ago

CWE-1333 - The d3-color module provides representations for various color spaces in the browser. d3-color versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service.

CWE-284 - Webpack 5.0.0-alpha.0 through 5.75.0 does not avoid cross-realm object access. ''ImportParserPlugin.js'' mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

CWE-1333 - The package terser before 4.8.1, and 5.0.x before 5.14.2 is vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

yosifkit commented 9 months ago

😕 I don't see any of these packages in the image. There definitely aren't any javascript packages installed.

https://github.com/docker-library/golang/blob/fc56cbca1a992efe6fd4d8e8aa7ba6640f4235a9/1.21/alpine3.18/Dockerfile#L9

Mari0Strife commented 9 months ago

ok thanks, but i run alpine doker image and have same vulnerabilities, so, i dont know if fix in this image or is external?

tianon commented 9 months ago

Please do a bit more research into why your tool is reporting these on our image.

https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves is probably relevant/useful