Images based on Alpine 3.9 don't pass vulnerability scanner

[camp-007]

Steps to reproduce the issue

1. Running docker image vulnerability scanners (in our case Clair from coreos) on mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine produces vulnerability warnings for CVE-2019-14697.

Expected behavior

Latest asp.net core docker images should ideally remain patched and not report vulnerabilities if possible. Obviously the .net core images are dependent on their base official images. In this case it seems Alpine has addressed the vulnerability but did so in a minor version instead of a patch to 3.9 (See alpinelinux/docker-alpine#34).

If I understand the .net core tagging scheme, this means that mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine will not automatically be patched, and that users will need to opt in to use an mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine3.10 image instead. Is that correct?

I see that an alpine 3.10 based version is available in the nightly builds, is there an ETA for this image to be published in the official repo?

From what I can tell, it seems the alpine 3.10 image has been available for a couple of months (even though .net core 3.0 images were just barely released). Since it seems they fix vulnerabilities in minor version updates (instead of patches), what is the expected time-frame in which we can expect official .net core images to adopt new OS minor versions? Those of us in enterprise/corporate environments need to be able to build on .net core and still satisfy compliance policies. Our organization is still early in our adoption of .net core on docker and trying to put together our security policies, so forgive me if I'm misunderstanding the landscape and my expectations are unreasonable.

Thanks for any help or info you can provide!

[MichaelSimons]

The alpine:3.9 tag references the same image as the alpine:3.9.4 image. The Alpine Docker Hub page indicates this as well.

PS D:\> docker pull alpine:3.9
3.9: Pulling from library/alpine
Digest: sha256:7746df395af22f04212cd25a92c1d6dbc5a06a0ca9579a229ef43008d4d1302a
Status: Image is up to date for alpine:3.9
docker.io/library/alpine:3.9
PS D:\> docker history alpine:3.9
IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
055936d39205        5 months ago        /bin/sh -c #(nop)  CMD ["/bin/sh"]              0B
<missing>           5 months ago        /bin/sh -c #(nop) ADD file:a86aea1f3a7d68f6a…   5.53MB
PS D:\> docker pull alpine:3.9.4
3.9.4: Pulling from library/alpine
Digest: sha256:7746df395af22f04212cd25a92c1d6dbc5a06a0ca9579a229ef43008d4d1302a
Status: Image is up to date for alpine:3.9.4
docker.io/library/alpine:3.9.4
PS D:\> docker history alpine:3.9.4
IMAGE               CREATED             CREATED BY                                      SIZE                COMMENT
055936d39205        5 months ago        /bin/sh -c #(nop)  CMD ["/bin/sh"]              0B
<missing>           5 months ago        /bin/sh -c #(nop) ADD file:a86aea1f3a7d68f6a…   5.53MB

The .NET Core images get automatically rebuilt whenever a base image is updated. I confirmed the mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine image is based on the latest alpine:3.9 image

PS D:\> docker inspect --format "{{ json .RootFS.Layers }}" alpine:3.9
["sha256:f1b5933fe4b5f49bbe8258745cf396afe07e625bdab3168e364daf7c956b6b81"]
PS D:\> docker pull mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine
3.0-alpine: Pulling from dotnet/core/runtime-deps
Digest: sha256:d5e7d48bf3f7866ca8c4296dc10575ec93c3ae3c9a158fa648b56618180e2797
Status: Image is up to date for mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine
mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine
PS D:\> docker inspect --format "{{ json .RootFS.Layers }}" mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine
["sha256:f1b5933fe4b5f49bbe8258745cf396afe07e625bdab3168e364daf7c956b6b81","sha256:54fc4b3d1f377edcf5c8d890126895bd5e6ef8f2992c78e13f9d86b173fce093"]

@camp-007, have you verified you don't have an older version of the mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine image cached on disk?

3.10 image production is blocked on test sign-off from the product teams. e.g. https://github.com/dotnet/coreclr/issues/26661

[MichaelSimons]

@camp-007 - Can you share the digest of the mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine image you have on disk?

docker inspect --format "{{ json .RepoDigests }}" mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine

[camp-007]

Yes, that digest matches the one I'm using

["mcr.microsoft.com/dotnet/core/runtime-deps@sha256:d5e7d48bf3f7866ca8c4296dc10575ec93c3ae3c9a158fa648b56618180e2797"]

However, I believe the problem is that the latest Alpine 3.9 images are still vulnerable. From looking at the Alpine issue, it appears they have only fixed the issue in their Alpine 3.10 image.

I realize that this means that mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine will still have the vulnerability (since it is based on Alpine 3.9), but I guess my concern is more around the timing of the availability of a 3.10 based version to mitigate the vulnerability.

Thanks for linking to https://github.com/dotnet/coreclr/issues/26661. It seems that may be the root of the issue. I can post a comment in that issue to hopefully make it clear it is important from vulnerability patching perspective.

[MichaelSimons]

FYI - .NET Core Alpine 3.10 images were released today. See the announcement for more details.

[vitaliipanchenko]

Hello, same issue for 3.10 image

[mthalman]

@vitaliipanchenko - Have you run the scan on the alpine:3.10.3 tag? That's the base image being referenced in this release.

[MichaelSimons]

The VSE-2019-14697 vulnerability still exists in the alpine:3.10.3 base image. You can see it being reported in the vulnerability scan

[camp-007]

According to the alpine repo (alpinelinux/docker-alpine#34), CVE-2019-14697 was addressed/fixed in alpine 3.10. This matches what I'm seeing. Now scanning our images based on mcr.microsoft.com/dotnet/core/runtime-deps:3.0-alpine (which is now based on alpine 3.10) Clair is no longer reporting CVE-2019-14697.

From my perspective, this issue is resolved. I very much appreciate the effort on getting the new alpine 3.10 images out.

I will give the constructive feedback that in highly regulated enterprise environments, vulnerabilities found in the base images raise a lot of red flags and compliance issues. In this scenario it was frustrating that 1) Alpine 3.9 images weren't patched and/or 2) dotnet core images couldn't have alpine 3.10 variants in a quicker time-frame.

[mthalman]

@camp-007 - Thanks for the feedback. We've been working on updates to our process to get new versions published sooner. Docker images are at the top of the product stack so having new images available in response to a version update isn't going to be an immediate thing. But things should go better than with the Alpine 3.10 release; if not, call us out on it.

[MichaelSimons]

Closing as 3.10 images are now available.