Get curl security updates. - #202
Conversation
e19853e to
9129c8c
Compare
| RUN cd / && npm install --production \ | ||
| RUN apt-get update \ | ||
| # Update some installed packages to get security fixes. | ||
| && apt-get install -y --no-install-recommends curl \ |
There was a problem hiding this comment.
only install what we want upgraded... https://ubuntu.com/blog/we-reduced-our-docker-images-by-60-with-no-install-recommends
There was a problem hiding this comment.
The Vulnerability Advisor of the IBM Cloud Container Registry showed 3 CVEs for the current version of curl:
Vulnerability ID Policy Status Affected Packages How to Resolve
CVE-2019-5436 Active curl Upgrade curl to >= 7.52.1-5+deb9u10
CVE-2019-5481 Active curl Upgrade curl to >= 7.52.1-5+deb9u10
CVE-2019-5482 Active curl Upgrade curl to >= 7.52.1-5+deb9u10
Since we want to have this fix available fast, we added it here. Once the fixed curl version is part of the base image we use, the install here will become a nop.
And yes, there are other runtimes that are affected, too. I created a PR for the runtime-python repository (ibm-functions/runtime-python#104). Others probably will follow.
| && rm -rf /var/lib/apt/lists/* \ | ||
| # Start adding/updating npm packages. | ||
| && cd / \ | ||
| && npm install --production \ |
|
@falkzoll did you carry this security fix over to Apache OpenWhisk? It would be bad precedent to have a IBM not supply known security fixes to their supposed upstream... |
|
No worries, this is not the case. We just shorten the time until the runtime image in this repository receives the security fix. To avoid this delay until we can jump to the updated Apache Openwhisk base image that includes the security fix, we do the |
|
@falkzoll thanks for your thorough answer ;) |
3 participants
No description provided.