Latest stable docker image (3.6.1) has CVE-2022-40674

[JacekLakis-TomTom]

Hello, thank you for your work!
There's no stable release of docker image that is free from vulnerabilities.

What happened:
Latest stable image (3.6.1) has CVE-2022-40674 vulnerability. Latest master image (which is master-cea4f8c at the moment) doesn't have this issue anymore, but we would like to use images from official releases in our system.

What you expected to happen:
New stable version without CVE exposure is released.

How to reproduce it (as minimally and precisely as possible):

$ docker pull grafana/grafana-image-renderer:3.6.1
$ trivy image docker.io/grafana/grafana-image-renderer:3.6.1

Thank you in advance, short information about when do you plan to release new stable version would be really helpful.

[joanlopez]

Hey @JacekLakis-TomTom,

Thanks for your request. We'll try to do a new release along this week.

[JacekLakis-TomTom]

@joanlopez Any update here?

[joanlopez]

Hi @JacekLakis-TomTom,

Sorry for the delay, we finally generated the new release v3.6.2, which I hope it helps with your issue. It's also available through the Grafana plugin's site.

It looks safe:

> trivy image docker.io/grafana/grafana-image-renderer:3.6.2
2022-11-23T11:30:41.967+0100    INFO    Vulnerability scanning is enabled
2022-11-23T11:30:41.967+0100    INFO    Secret scanning is enabled
2022-11-23T11:30:41.967+0100    INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-23T11:30:41.967+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.34/docs/secret/scanning/#recommendation for faster secret detection
2022-11-23T11:33:51.255+0100    INFO    Detected OS: alpine
2022-11-23T11:33:51.257+0100    INFO    Detecting Alpine vulnerabilities...
2022-11-23T11:33:51.281+0100    INFO    Number of language-specific files: 1
2022-11-23T11:33:51.282+0100    INFO    Detecting node-pkg vulnerabilities...

docker.io/grafana/grafana-image-renderer:3.6.2 (alpine 3.16.3)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

So, do you think now we can close this issue?

Thanks!

[JacekLakis-TomTom]

Thank you @joanlopez !