"This image has vulnerabilities" on Docker Hub

[teohhanhui]

No description provided.

[Starefossen]

Hi @teohhanhui,

Where does it say that? And for which tag?

[teohhanhui]

@Starefossen

https://hub.docker.com/r/library/node/tags/

Basically for all of the current tags... Could be due to buildpack-deps being vulnerable? I've also opened an issue there: docker-library/buildpack-deps#46

[chorrell]

It looks like the vulnerabilities are in the base jessie and wheezy, but it seems to be picking up v8 stuff too.

https://hub.docker.com/r/library/node/tags/6/

[chorrell]

I'm not sure if those v8 vulnerabilities are necessarily relevant to Node.js or not.

There is an update coming this week that might be related:

https://nodejs.org/en/blog/vulnerability/june-2016-security-releases/

[chorrell]

I think we might be waiting on docker-library/official-images#1767 and some other things: docker-library/official-images#1764

[chorrell]

Huh, so now I don't see any security warnings on https://hub.docker.com/r/library/node/tags/ and https://hub.docker.com/r/library/node/tags/6/ returns a 404...

[chorrell]

Ah, ignore me, apparently you need to be logged in to see the security report.

[tianon]

If you wait just a tad bit longer, the updated tags will be finished pushing (not entirely sure how long after that the updated CVE scan results will take to show up). 👍

[Starefossen]

Thanks for the update Tianon 👍🏼

On 24. juni 2016, at 03:56, Tianon Gravi [email protected] wrote:

If you wait just a tad bit longer, the updated tags will be finished
pushing (not entirely sure how long after that the updated CVE scan results
will take to show up). 👍
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.

[zerogvt]

This hasn't been updated in a while.
Are vulnerabilities still detected on wheezy based images?

[teohhanhui]

@Winglet It'd seem so.

[zerogvt]

@teohhanhui thanks

[chorrell]

I'm not sure what else we can do about this. I assumed that a lot of the vulnerabilities in the base images would be resolved by now...

[yosifkit]

The vulnerabilities are usually waiting for a fix to land in Debian. But many are given a no-dsa which means the Debian Security team deems it a minor issue and are not actively fixing it, like in node:6.3.0-wheezy, there is CVE-2014-9761 and CVE-2013-2207 in glibc. Then there are sometimes false positives like CVE-2015-8777 that are fixed in Debian and the fixed version is installed.

[chorrell]

Ah, ok, thanks for the context.

@teohhanhui OK to close this out now?

[jmreicha]

Is there anything that can be done or do these vulnerabilities need to get patched upstream?