Please update the OS

[paradoxengine]

Hi,
it seems that this image is vulnerable to the following "shellshock related" bugs.
CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-6277, CVE-2014-6278
I have no idea if they are exploitable given your use case, but you probably want to update the OS just in case.

[itzg]

Thanks for pointing this out. I knew this from work, but didn't make the mental connection back to these Docker images :)

The latest build of itzg/ubuntu-openjdk-7 is at rev e545342bf796, which in turn is based on ubuntu:trusty at rev 9cbaf023786c. I have several images based on itzg/ubuntu-openjdk-7, but wanted to target primarily itzg/minecraft-server -- rev 56ab8899be22 is re-based on the latest.

Just to be sure I checked the dpkg info of bash:

$ docker run -it --rm itzg/ubuntu-openjdk-7 bash
root@260099bde6bd:/# dpkg-query -s bash
Package: bash
Essential: yes
Status: install ok installed
Priority: required
Section: shells
Installed-Size: 1488
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Multi-Arch: foreign
Version: 4.3-7ubuntu1.5

which seems to be the recommended package in the Ubuntu Trusty line.

[paradoxengine]

Looks good, thanks for the quick fix. If you want to be extra sure you can consider running https://github.com/hannob/bashcheck on the image via docker run (which is what I've done to detect the issue).

[itzg]

If only to educate myself I'll run that bashcheck. Thanks.