Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] security vulnerabilities #1112

Open
pharindoko opened this issue Jan 18, 2023 · 7 comments
Open

[BUG] security vulnerabilities #1112

pharindoko opened this issue Jan 18, 2023 · 7 comments
Labels
type: bug something is broken, we need to fix it

Comments

@pharindoko
Copy link

Self Hosted
fider 21.1

Describe the bug
Found a lot of security vulnerabilities scanning the current stable image
https://trivy.dev/results/?image=getfider/fider:stable

To Reproduce
Steps to reproduce the behavior:

  1. Go to 'https://trivy.dev/'
  2. Click on 'Scan'

Expected behavior
Regular dependency updates for container images
@pharindoko pharindoko added the type: bug something is broken, we need to fix it label Jan 18, 2023
@goenning
Copy link
Member

Hey Florian, can you try running on getfider/fider:main?

This one is 2 months old, so it should report less vulnerabilities , but I'll build another image soon to catch the latest patches from upstream images

@goenning
Copy link
Member

I tried re-scanning the image (getfider/fider:main), but it seems to be using a cached version. Do you know how to force a pull and re-scan it?

@pharindoko
Copy link
Author

Hey @goenning

I guess your best option is to scan your local docker image using trivy.

@pharindoko
Copy link
Author

Hey Florian, can you try running on getfider/fider:main?

This one is 2 months old, so it should report less vulnerabilities , but I'll build another image soon to catch the latest patches from upstream images

Yes the main versions has less critical issues found.
But I would like to use the last stable state.

@goenning
Copy link
Member

Yeah, it's been a while since the last release, I'll get a new one released soon.

@asos-robbell
Copy link

Hi @goenning — any update on this? Bumping to the following will resolve all of the critical vulnerabilities:

FROM --platform=${TARGETPLATFORM:-linux/amd64} golang:1.19-bookworm AS server-builder 
...
FROM --platform=${TARGETPLATFORM:-linux/amd64} node:16-bookworm AS ui-builder 
...
FROM --platform=${TARGETPLATFORM:-linux/amd64} debian:bookworm-slim

Happy to raise a PR

@goenning
Copy link
Member

Hey @asos-robbell I'd be happy to review and merge a PR. Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type: bug something is broken, we need to fix it
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@goenning @pharindoko @asos-robbell