search

fmartinou / whats-up-docker

What's up Docker ( aka WUD ) gets you notified when a new version of your Docker Container is available.
https://fmartinou.github.io/whats-up-docker
MIT License
921 stars 29 forks source link

Rebuild Docker image to update dependencies #383

Closed ngosang closed 1 month ago

ngosang commented 2 months ago

I was doing a security scanner using Grype => https://github.com/anchore/grype And I detected your Docker image has some outdated dependencies. I don't think they are a security risk but it's a good practice to publish releases more often. Thank you for your work!

Docker image: fmartinou/whats-up-docker:6.3.0
busybox              1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical  
busybox-binsh        1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical  
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20211202192323-5770296d904e  go-module  GHSA-gwc9-m7rh-j2ww  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20200220183623-bac4c82f6975  go-module  GHSA-ffhg-7mh4-33c4  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20200124225646-8b5121be2f68  go-module  GHSA-cjjc-xp8v-855w  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20220314234659-1baeb1ce4c0b  go-module  GHSA-8c26-wmh5-6g9v  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20201216223049-8b5274cf687f  go-module  GHSA-3vm4-22fp-5rfm  High      
libcrypto3           3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
libssl3              3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
openssl              3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
ssl_client           1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical
fmartinou commented 1 month ago

Thanks for the recommendation :)

There is now a newer 6.4.0 version.