Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release new lambda/dotnet:8 to address CVE-2024-37371 #197

Open
jenademoodley opened this issue Sep 24, 2024 · 0 comments
Open

Release new lambda/dotnet:8 to address CVE-2024-37371 #197

jenademoodley opened this issue Sep 24, 2024 · 0 comments

Comments

@jenademoodley
Copy link

Hi team,

Checking the latest version of the lambda/dotnet:8 image shows it is using an older version of the krb5-libs package which is vulnerable to CVE-2024-37371:

$ docker run --rm -it --entrypoint '/bin/bash' public.ecr.aws/lambda/dotnet:8 -c 'rpm -qa | grep krb'
krb5-libs-1.21-3.amzn2023.0.4.x86_64

As per ALAS-2024-688, the fix is in package version krb5-libs-1.21.3-1.amzn2023.0.1.x86_64.

Issue also discussed in #171 for the lambda/nodejs:20 image but I see the package was previously updated within the latest image.

Can we update the package in this image as well?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant