High security findings about uvicorn-gunicorn-fastapi-docker HOT 5 CLOSED

@gbvanrenswoude I wasn't seeing it because I was using the alpine image so thanks for pointing that out apologies about that. Github did add a way for owners to create security policies for situations like this, should they arise. There is zero problem reporting the issue; rather, it's the manner in which you report it.

from uvicorn-gunicorn-fastapi-docker.

In the image where do you see perl? Also, why would you create a Github issue for possible security findings instead of sending an email?

from uvicorn-gunicorn-fastapi-docker.

@NotoriousRebel

docker run --rm -it tiangolo/uvicorn-gunicorn:python3.8-slim which perl
/usr/bin/perl

Lots of Docker Images are notoriously vulnerable due to people not caring enough to deliver a clean FS and up-to-date binaries. Personally I think he is setting a good example and I fail to see why reporting this as an issue instead of a mail would be a problem.

from uvicorn-gunicorn-fastapi-docker.

Fixed it with the alpine image, thanks! I don't mind doing it via security policy but there isn't one for this repository

from uvicorn-gunicorn-fastapi-docker.

Thanks for the help here @NotoriousRebel ! 👏 🙇

The image is based on the official Python image, so it wouldn't be an issue with this image but with the base official Python image. On the other side, Perl is not used for anything, it's there just because it's a common tool to have pre-installed and could be needed while building extensions, etc. But nothing calls or uses it.

Anyway, thanks for reporting back and closing the issue @Arrrunan 👍

from uvicorn-gunicorn-fastapi-docker.