Multiple vulnerabilities present in dius/pact-broker image v2.68.1.0 about pact_broker-docker HOT 7 OPEN

Just a couple. Looks like I've added trivy to the pact-foundation one but not the dius one yet.

from pact_broker-docker.

That seems to have done the trick https://github.com/DiUS/pact_broker-docker/runs/1899455773?check_suite_focus=true#step:3:851

from pact_broker-docker.

I was going to raise an issue for that - but if you're happy I'll just add it straight in.

from pact_broker-docker.

So, I'm not sure how to get rid of the vulnerabilities. They're all OS level vulnerabilities, not Ruby gem ones. We're on the latest version of passenger phusion for Ruby 2.7, and we're already doing:

# Update OS as per https://github.com/phusion/passenger-docker#upgrading-the-operating-system-inside-the-container
RUN apt-get update && \
    apt-get upgrade -y -o Dpkg::Options::="--force-confold" && \
    apt-get -qy autoremove && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

See: https://github.com/DiUS/pact_broker-docker/runs/1883720574?check_suite_focus=true#step:4:159

What else can we do to force an upgrade of EVERYTHING? Any thoughts @k-ong?

from pact_broker-docker.

You managed to at least remove all of the HIGH vulnerabilities and over 100 MEDIUM - so we're on track, but Phusion does at least agree there are problems with the base image:

(via: http://phusion.github.io/baseimage-docker/)

Jokes aside, according to the trivy scan at least, there are no fixes for the remaining vulnerabilities. So, not sure how to move forward.

we could update the trivy scan to not fail the build unless there are high vulnerabilities and make a note to keep an eye on the remaining MEDIUMs? It's also possible that some of those dependencies aren't needed, but that could involve a lot of trial/error to find out.

from pact_broker-docker.

I've updated it to trivy filesystem --severity HIGH,CRITICAL --ignore-unfixed for now so we can actually get a release out.

from pact_broker-docker.

nice one, thanks Beth. Let's leave this open so if somebody comes along they can see it. It will no doubt fail when there is a fix for them, so we can close it off then.

from pact_broker-docker.