Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #676: Update dockerfile; Update alpine base images; Fix multiple CVEs #677

Merged
merged 2 commits into from
Jun 30, 2022

Conversation

hilariocoelho
Copy link
Contributor

@hilariocoelho hilariocoelho commented May 13, 2022

Fixes #676 by updating alpine base image.

Current image:

% syft appleboy/gorush --output json | grype                                                                     
 ✔ Loaded image            
 ✔ Parsed image            
 ✔ Cataloged packages      [102 packages]

[0001]  WARN some package(s) are missing CPEs. This may result in missing vulnerabilities. You may autogenerate these using: --add-cpes-if-none
NAME                                 INSTALLED  FIXED-IN   TYPE       VULNERABILITY        SEVERITY 
busybox                              1.34.1-r3  1.34.1-r5  apk        CVE-2022-28391       Critical  
github.com/google/flatbuffers        v1.12.0               go-module  CVE-2020-35864       High      
github.com/prometheus/client_golang  v1.10.0               go-module  CVE-2022-21698       High      
github.com/tidwall/gjson             v1.6.8     1.9.3      go-module  GHSA-ppj4-34rq-v8j9  High      
google.golang.org/protobuf           v1.28.0               go-module  CVE-2015-5237        High      
google.golang.org/protobuf           v1.28.0               go-module  CVE-2021-22570       High      
libcrypto1.1                         1.1.1l-r7  1.1.1n-r0  apk        CVE-2022-0778        High      
libcrypto1.1                         1.1.1l-r7             apk        CVE-2021-4160        Medium    
libretls                             3.3.4-r2   3.3.4-r3   apk        CVE-2022-0778        High      
libssl1.1                            1.1.1l-r7             apk        CVE-2021-4160        Medium    
libssl1.1                            1.1.1l-r7  1.1.1n-r0  apk        CVE-2022-0778        High      
ssl_client                           1.34.1-r3  1.34.1-r5  apk        CVE-2022-28391       Critical  
zlib                                 1.2.11-r3  1.2.12-r0  apk        CVE-2018-25032       High  

After alpine image update:

% syft spawn2kill/gorush --output json | grype
 ✔ Loaded image            
 ✔ Parsed image            
 ✔ Cataloged packages      [102 packages]
[0001]  WARN some package(s) are missing CPEs. This may result in missing vulnerabilities. You may autogenerate these using: --add-cpes-if-none
NAME                           INSTALLED  FIXED-IN  TYPE       VULNERABILITY        SEVERITY 
github.com/google/flatbuffers  v1.12.0              go-module  CVE-2020-35864       High      
github.com/tidwall/gjson       v1.6.8     1.9.3     go-module  GHSA-ppj4-34rq-v8j9  High      
google.golang.org/protobuf     v1.28.0              go-module  CVE-2021-22570       High      
google.golang.org/protobuf     v1.28.0              go-module  CVE-2015-5237        High      

@appleboy appleboy merged commit 409c0d7 into appleboy:master Jun 30, 2022
@appleboy appleboy added this to the v1.16.0 milestone Dec 18, 2022
@appleboy
Copy link
Owner

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update alpine base image - Fix CVEs
2 participants