Multiple vulnerabilities present in dius/pact-broker image v2.68.1.0 #105
Comments
|
Just a couple. Looks like I've added trivy to the pact-foundation one but not the dius one yet. |
|
I was going to raise an issue for that - but if you're happy I'll just add it straight in. |
|
So, I'm not sure how to get rid of the vulnerabilities. They're all OS level vulnerabilities, not Ruby gem ones. We're on the latest version of passenger phusion for Ruby 2.7, and we're already doing: See: https://github.com/DiUS/pact_broker-docker/runs/1883720574?check_suite_focus=true#step:4:159 What else can we do to force an upgrade of EVERYTHING? Any thoughts @k-ong? |
|
You managed to at least remove all of the HIGH vulnerabilities and over 100 MEDIUM - so we're on track, but Phusion does at least agree there are problems with the base image: (via: http://phusion.github.io/baseimage-docker/) Jokes aside, according to the trivy scan at least, there are no fixes for the remaining vulnerabilities. So, not sure how to move forward. we could update the trivy scan to not fail the build unless there are high vulnerabilities and make a note to keep an eye on the remaining MEDIUMs? It's also possible that some of those dependencies aren't needed, but that could involve a lot of trial/error to find out. |
|
I've updated it to |
|
That seems to have done the trick https://github.com/DiUS/pact_broker-docker/runs/1899455773?check_suite_focus=true#step:3:851 |
|
nice one, thanks Beth. Let's leave this open so if somebody comes along they can see it. It will no doubt fail when there is a fix for them, so we can close it off then. |
Using trivvy to scan this container presents the following vulnerabilities:
The text was updated successfully, but these errors were encountered: