Vulnerabilities in ibmjava:8-jre image

BillyDawsonWork commented 8 months ago

Hi team, we pull the base image ibmjava:8-jre as part of our deployment which is currently showing the following vulnerabilities to be patched:

Ubuntu 20.04 ESM: NTP vulnerability (USN-5175-1) - Medium - Patch due in 16 days
Ubuntu 20.04 LTS: libxml2 vulnerability (USN-6658-1) - High - Patch due in 18 days
Ubuntu 20.04 LTS: GNU binutils vulnerabilities (USN-6655-1) - High - Patch due in 18 days
Ubuntu 20.04 LTS: less vulnerability (USN-6664-1) - Critical - Patch due in 18 days
Ubuntu 20.04 LTS: libuv vulnerability (USN-6666-1) - High - Patch due in 21 days
Ubuntu 20.04 LTS: python-cryptography vulnerabilities (USN-6673-1) - High - Patch due in 26 days
Ubuntu 20.04 LTS: Linux kernel vulnerabilities (USN-6681-1) - High - Patch due in 26 days

Is there an expected timeline for these to be resolved please? TIA

jayasg12 commented 7 months ago

Hi @BillyDawsonWork IBM java images on Dockerhub is refreshed 3 days ago , can you please check with this image once https://hub.docker.com/layers/library/ibmjava/8-jre/images/sha256-52699b2ec28740b6d74c75f342b271b8c1c035f05b12325aae0bfbd49a45146d?context=explore to see if you are still seeing the vulnerabilities. And it is based on ubuntu 22.04.

BillyDawsonWork commented 7 months ago

Hi there, thank you very much for this, picked up the new image for our deployment last week and can see the dashboard is now looking good :)

ibmruntimes / ci.docker