CRITICAL security vulnerability reported in image scan (python:3.7.4-slim-buster) #413
Description
I am using python:3.7.4-slim-buster docker image for a python application which is a Linux based docker container image. I received the results from a BlackDuck (BD) image scan on my container image and has a reported CRITICAL security vulnerability for BerkeleyDB 5.3.28. I was wondering if someone can help me suggest a way to solve the issue.
The BD report suggests upgrade from BerkeleyDB 5.3.28 to v6.2.31 will fix the vulnerability. Most recent being v18.1.32. Digging down into the root of the container I found libdb-5.3.so listed in the following dir:
root@08ad4950b59f:/usr/lib/x86_64-linux-gnu# ls
audit libexpatw.so.1 liblz4.so.1 libsqlite3.so.0.8.6
coreutils libexpatw.so.1.6.8 liblz4.so.1.8.3 libssl.so.1.1
engines-1.1 libffi.so.6 libmenuw.so.6 libstdc++.so.6
gconv libffi.so.6.0.4 libmenuw.so.6.1 libstdc++.so.6.0.25
libacl.so.1 libformw.so.6 libnettle.so.6 libtasn1.so.6
libacl.so.1.1.2253 libformw.so.6.1 libnettle.so.6.5 libtasn1.so.6.5.5
libapt-pkg.so.5.0 libgdbm.so.6 libp11-kit.so.0 libtic.so.6
libapt-pkg.so.5.0.2 libgdbm.so.6.0.0 libp11-kit.so.0.3.0 libtic.so.6.1
libapt-private.so.0.0 libgmp.so.10 libpanelw.so.6 libunistring.so.2
libapt-private.so.0.0.0 libgmp.so.10.3.2 libpanelw.so.6.1 libunistring.so.2.1.0
libattr.so.1 libgnutls.so.30 libpcreposix.so.3 libzstd.so.1
libattr.so.1.1.2448 libgnutls.so.30.23.2 libpcreposix.so.3.13.3 libzstd.so.1.3.8
libcrypto.so.1.1 libhogweed.so.4 libseccomp.so.2 perl
libdb-5.3.so libhogweed.so.4.5 libseccomp.so.2.3.3 perl-base
libdebconfclient.so.0 libidn2.so.0 libsemanage.so.1
libdebconfclient.so.0.0.0 libidn2.so.0.3.4 libsqlite3.so.0
Also, the BD report lists the following as the source of the vulN:
debian libdb5.3/5.3.28+dfsg1-0.5/amd64
I wonder what is a way to upgrade this package called BerkeleyDB and how can it be done. Thanks in advance for any help on this matter.