Skip to content
This repository was archived by the owner on Jan 17, 2025. It is now read-only.

Get curl security updates. #202

Merged
merged 1 commit into from
Feb 27, 2020
Merged

Get curl security updates. #202

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion nodejs10/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ COPY ./package.json /

RUN apt-get update \
# Update some installed packages to get security fixes.
&& apt-get install -y --no-install-recommends e2fsprogs file git openssl subversion \
&& apt-get install -y --no-install-recommends curl e2fsprogs file git openssl subversion \
# Cleanup apt data, we do not need them later on.
&& rm -rf /var/lib/apt/lists/* \
# We do not have mysql-server installed but mysql-common contains config files (/etc/mysql/my.cnf) for it.
Expand Down
2 changes: 1 addition & 1 deletion nodejs12/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ COPY ./package.json /

RUN apt-get update \
# Update some installed packages to get security fixes.
&& apt-get install -y --no-install-recommends e2fsprogs file git openssl subversion \
&& apt-get install -y --no-install-recommends curl e2fsprogs file git openssl subversion \
# Cleanup apt data, we do not need them later on.
&& rm -rf /var/lib/apt/lists/* \
# We do not have mysql-server installed but mysql-common contains config files (/etc/mysql/my.cnf) for it.
Expand Down
10 changes: 9 additions & 1 deletion nodejs8/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
FROM openwhisk/action-nodejs-v8:3e843c0
COPY ./package.json /
RUN cd / && npm install --production \
RUN apt-get update \
# Update some installed packages to get security fixes.
&& apt-get install -y --no-install-recommends curl \
Copy link

@mrutkows mrutkows Feb 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

only install what we want upgraded... https://ubuntu.com/blog/we-reduced-our-docker-images-by-60-with-no-install-recommends

Copy link
Contributor Author

@falkzoll falkzoll Feb 27, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Vulnerability Advisor of the IBM Cloud Container Registry showed 3 CVEs for the current version of curl:

    Vulnerability ID   Policy Status   Affected Packages   How to Resolve
    CVE-2019-5436      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10
    CVE-2019-5481      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10
    CVE-2019-5482      Active          curl                Upgrade curl to >= 7.52.1-5+deb9u10

Since we want to have this fix available fast, we added it here. Once the fixed curl version is part of the base image we use, the install here will become a nop.
And yes, there are other runtimes that are affected, too. I created a PR for the runtime-python repository (ibm-functions/runtime-python#104). Others probably will follow.

# Cleanup apt data, we do not need them later on.
&& rm -rf /var/lib/apt/lists/* \
# Start adding/updating npm packages.
&& cd / \
&& npm install --production \
Copy link

@mrutkows mrutkows Feb 26, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding this...

&& npm cache clean --force

COPY iam-client/iam-openwhisk-main.js /node_modules/openwhisk/lib/
RUN sed -i.bak 's/lib\/main.js/lib\/iam-openwhisk-main.js/' /node_modules/openwhisk/package.json