search

docker-library / openjdk

Docker Official Image packaging for EA builds of OpenJDK from Oracle
http://openjdk.java.net
MIT License
1.14k stars 471 forks source link

Vulnerabilities in openjdk:17.0.2-slim - CVE-2022-1292,CVE-2022-1271,CVE-2022-1664 #503

Closed vasilzaturenski closed 2 years ago

vasilzaturenski commented 2 years ago

Hi openjdk team! I'm using openjdk:17.0.2-slim image based on debian:buster-slim and vulnerabilities from the subject were reported by AWS Inspector. Debian team already patched their images and published in dockerhub - issue bellow: https://github.com/debuerreotype/docker-debian-artifacts/issues/161 Last update of openjdk:17.0.2-slim has been done month ago. Can we expect an update of 17.0* images in dockerhub? Thanks in advance and best regards, Vasil

wglambert commented 2 years ago

There no longer exist "official" (or even semi-official) vanilla builds of OpenJDK 17 suitable for our use or for publishing as "OpenJDK" (https://jdk.java.net/17/)

See https://github.com/docker-library/openjdk/pull/495 for where the image was removed from openjdk. Since there are no plain builds of openjdk 17 available, then we had no choice but to remove it and users are forced to choose one of the vendor-supplied JDKs.

See also https://github.com/docker-library/docs/pull/2142 and https://github.com/docker-library/tomcat/issues/260.