From af126a676232b5240943aa4b65390720b259f5a5 Mon Sep 17 00:00:00 2001 From: Matteo Merli Date: Wed, 24 Jan 2024 09:10:24 -0800 Subject: [PATCH] Update Alpine base image to 3.19 (#433) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addressing security issues ``` oxia:latest (alpine 3.18.4) Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0) ┌────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤ │ libcrypto3 │ CVE-2023-6129 │ MEDIUM │ fixed │ 3.1.4-r1 │ 3.1.4-r3 │ openssl: POLY1305 MAC implementation corrupts vector │ │ │ │ │ │ │ │ registers on PowerPC │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6129 │ │ ├───────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤ │ │ CVE-2023-6237 │ │ │ │ 3.1.4-r4 │ openssl: Excessive time spent checking invalid RSA public │ │ │ │ │ │ │ │ keys │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6237 │ ├────────────┼───────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤ │ libssl3 │ CVE-2023-6129 │ │ │ │ 3.1.4-r3 │ openssl: POLY1305 MAC implementation corrupts vector │ │ │ │ │ │ │ │ registers on PowerPC │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6129 │ │ ├───────────────┤ │ │ ├───────────────┼───────────────────────────────────────────────────────────┤ │ │ CVE-2023-6237 │ │ │ │ 3.1.4-r4 │ openssl: Excessive time spent checking invalid RSA public │ │ │ │ │ │ │ │ keys │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6237 │ └────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘ ``` --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index ff1cf099..1dcddefd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -22,11 +22,11 @@ ADD . /src/oxia RUN cd /src/oxia \ && make -FROM alpine:3.18.4 +FROM alpine:3.19 RUN apk add --no-cache bash bash-completion -# Fix CVE-2023-5363 by upgrading to OpenSSL 3.1.4-r1 +# Fix CVE-2023-5363 by upgrading to OpenSSL 3.1.4-r4 # We can remove once new Alpine image is released RUN apk upgrade --no-cache libssl3 libcrypto3