search

lmenezes / cerebro-docker

official cerebro docker image
118 stars 40 forks source link

Security issues in version 0.8.1 Docker image #1

Closed cmur2 closed 5 years ago

cmur2 commented 5 years ago

Hi, and thanks for providing this Docker image of your very useful software! I just used https://github.com/coreos/clair to assess the Docker image provided on Docker Hub for vulnerabilities and discovered that it inherits from openjdk:8-jre-alpine but was not rebuilt when the upstream image moved to Alpine 3.8.

==> Analyzing image lmenezes/cerebro:0.8.1
Analysing 4 layers
Found 6 vulnerabilities
CVE-2018-14600: [High]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14600
Affects: libx11 1.6.5-r1 in alpine:v3.7
Fixed in: 1.6.6-r0
-----------------------------------------
CVE-2018-14599: [High]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14599
Affects: libx11 1.6.5-r1 in alpine:v3.7
Fixed in: 1.6.6-r0
-----------------------------------------
CVE-2018-14598: [Medium]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14598
Affects: libx11 1.6.5-r1 in alpine:v3.7
Fixed in: 1.6.6-r0
-----------------------------------------
CVE-2018-1152: [Medium]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1152
Affects: libjpeg-turbo 1.5.2-r0 in alpine:v3.7
Fixed in: 1.5.3-r1
-----------------------------------------
CVE-2017-15232: [Medium]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15232
Affects: libjpeg-turbo 1.5.2-r0 in alpine:v3.7
Fixed in: 1.5.3-r0
-----------------------------------------
CVE-2018-11813: [Medium]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11813
Affects: libjpeg-turbo 1.5.2-r0 in alpine:v3.7
Fixed in: 1.5.3-r2
-----------------------------------------
Medium: 4
High: 2

Could you rebuilt and push this image for 0.8.1 to benefit from the vulnerabilities already fixed in Alpine?

moliware commented 5 years ago

Hi!

I've rebuilt the image 0.8.1 and also released 0.8.2. Hopefully all is good now

Thanks!