8000 vulnerability in base Alpine OS · Issue #73 · anapsix/docker-alpine-java · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

vulnerabilit 8000 y in base Alpine OS #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
fidesmo-mrc opened this issue Sep 14, 2018 · 3 comments
Closed

vulnerability in base Alpine OS #73

fidesmo-mrc opened this issue Sep 14, 2018 · 3 comments

Comments

@fidesmo-mrc
Copy link

there are several RCE bugs in apk-tools: https://justi.cz/security/2018/09/13/alpine-apk-rce.html

the bugs are fixed and the Alpine OS images updated,

Would it be possible to upgrade alpine to the latest 3.7 version?

thanks!
anapsix added a commit that referenced this issue Sep 14, 2018
@anapsix
README.md update, to trigger rebuild per #73
dfd2b68
@anapsix
Copy link
Owner
anapsix commented Sep 14, 2018 •
edited
Loading

thanks for bringing this up, I've triggered a rebuild of latest and 8u181b13_* tags

@anapsix anapsix closed this as completed Sep 14, 2018
@doublefx
Copy link

Hi, I was about to create an issue but seen this one, it seems to me the fix is in the 3.8.1, not in 3.7, see:

@anapsix
Copy link
Owner
anapsix commented Sep 18, 2018

Just for kicks, I've added a Java8 server-jre Dockerfile to Quay, here are vulnerability scan results

Do you think we are good?

$ docker images alpine:3.7
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
alpine              3.7                 34ea7509dcad        6 days ago          4.21MB

$ docker run -it --rm alpine:3.7 sh -c 'apk list apk-tools'
WARNING: Ignoring APKINDEX.70c88391.tar.gz: No such file or directory
WARNING: Ignoring APKINDEX.5022a8a2.tar.gz: No such file or directory
apk-tools-2.10.1-r0 x86_64 {apk-tools} (GPL2) [installed]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@doublefx @anapsix @fidesmo-mrc
0