search

jruby / docker-jruby

MIT License
18 stars 27 forks source link

9.2.8.0 images need to be rebuilt #57

Closed batessr closed 4 years ago

batessr commented 4 years ago

Due to a vulnerability in git version 1:2.11.0-3+deb9u4, the current 9.2.8.0 based images need to be rebuilt to update to git version 1:2.11.0-3+deb9u5.

batessr commented 4 years ago

More info: https://security-tracker.debian.org/tracker/CVE-2019-1349 https://security-tracker.debian.org/tracker/CVE-2019-1352

cpuguy83 commented 4 years ago

Thanks, this is handled in https://github.com/docker-library/official-images When the base image updates, the jruby image will be rebuilt.

batessr commented 4 years ago

The base image openjdk:8-jdk was updated four days ago, but the 9.2.8.0 images have not been updated for 4 months. Other versions such as 92.9.0 and 9.1.17.0 seem to have been updated.

cpuguy83 commented 4 years ago

That's because old versions are not updated. 9.2.8.0 is a patch release, 9.2.9.0 is the current jruby patch release supported. See https://github.com/docker-library/official-images/blob/master/library/jruby for the manifest of what gets built.

Older images still exist, but they are not updated unless they are listed in that manifest.