plantuml / plantuml-server

PlantUML Online Server
https://plantuml.com/
GNU General Public License v3.0
1.6k stars 462 forks source link

Update dependencies (security updates) #281

Closed HeinrichAD closed 1 year ago

HeinrichAD commented 1 year ago

Short: update maven artifacts and docker base image (as well as reduce there image size). This PR also close #253 that mentioned that the current used jetty version is vulnerable.

Update maven artifacts

Docker

There were same base image and naming changes for the jetty and tomcat images plantuml-server uses. Therefore, plantuml-server uses a rather old and vulnerable image, since there are no updates according to the old naming scheme.

HeinrichAD commented 1 year ago

As a hint why the update could be quite important. (I used trivy for the analysis.):

Jetty

Current available docker image online

plantuml/plantuml-server:jetty (debian 11.2)
============================================
Total: 516 (UNKNOWN: 6, LOW: 314, MEDIUM: 90, HIGH: 90, CRITICAL: 16)

After the update

plantuml-server:jetty-local (ubuntu 22.04)
==========================================
Total: 23 (UNKNOWN: 0, LOW: 20, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

Tomcat

Current available docker image online

plantuml/plantuml-server:tomcat (debian 11.4)
=============================================
Total: 499 (UNKNOWN: 6, LOW: 313, MEDIUM: 84, HIGH: 87, CRITICAL: 9)

After the update

plantuml-server:tomcat-local (ubuntu 22.04)
===========================================
Total: 23 (UNKNOWN: 0, LOW: 20, MEDIUM: 3, HIGH: 0, CRITICAL: 0)