Get curl security updates.

[falkzoll]

No description provided.

[mrutkows]

is there a reason we are "cherry picking" curl security fixes? Is there an associated issue and should we be doing this across other runtimes?

[mrutkows]

only install what we want upgraded... https://ubuntu.com/blog/we-reduced-our-docker-images-by-60-with-no-install-recommends

[falkzoll]

The Vulnerability Advisor of the IBM Cloud Container Registry showed 3 CVEs for the current version of curl:

    Vulnerability ID   Policy Status   Affected Packages   How to Resolve
    CVE-2019-5436      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10
    CVE-2019-5481      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10
    CVE-2019-5482      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10

Since we want to have this fix available fast, we added it here. Once the fixed curl version is part of the base image we use, the install here will become a nop.
And yes, there are other runtimes that are affected, too. I created a PR for the runtime-python repository (ibm-functions/runtime-python#104). Others probably will follow.

[mrutkows]

Thanks for adding this...

[mrutkows]

@falkzoll did you carry this security fix over to Apache OpenWhisk? It would be bad precedent to have a IBM not supply known security fixes to their supposed upstream...

[falkzoll]

No worries, this is not the case. We just shorten the time until the runtime image in this repository receives the security fix.
Most Apache openwhisk runtimes have automatically fetched this update in their nightly builds already. Unfortunately we can not immediately jump to this new version of the base runtime image. We need time to consume these updated images and to verify the other changes in them.

To avoid this delay until we can jump to the updated Apache Openwhisk base image that includes the security fix, we do the apt-get install here. When we are finally able to consume the updated Apache Openwhisk image, this update operation (apt-get install) here will be a 'no operation' action since the module (curl in this case) is already at the newest version from the new base image we then use.

[mrutkows]

@falkzoll thanks for your thorough answer ;)