search

getsentry / symbolicator

Native Symbolication as a Service
https://getsentry.github.io/symbolicator/
MIT License
352 stars 45 forks source link

Patch sentry-getsentry/symbolicator:23.9.1 vulnerabilities #1326

Closed ziler-orca closed 8 months ago

ziler-orca commented 8 months ago

Self-Hosted Version

23.9.1

CPU Architecture

x86_64

Docker Version

24.0.6

Docker Compose Version

v2.21.0

Steps to Reproduce

The sentry-getsentry/symbolicator image 23.9.1 has several vulnerabilities. Please see attached.

symbolicator_cves.xlsx

Expected Result

Patch the vulnerabilities.

Actual Result

Please refer to spreadsheet attached above for details.

Event ID

No response

hubertdeng123 commented 8 months ago

Thanks for reporting this to us. I'm going to transfer this over to getsentry/symbolicator. For reference, security has given us a csv file with all the CVEs.

symbolicator_cves.csv

Swatinem commented 8 months ago

All of these are in the base image packages, no are in symbolicators Rust code or any of the Rust dependencies.

So is there anything other to do here than to run an apt upgrade in the base docker image?

hubertdeng123 commented 8 months ago

So is there anything other to do here than to run an apt upgrade in the base docker image?

Guess not then 🙂

So the apt upgrade should be run in https://github.com/getsentry/symbolicator/blob/master/Dockerfile?