Security vulnerabilities in 1.20-alpine and 1.21-alpine

[wszydlak]

Hi, today scanned images based on 1.20-alpine and 1.21-alpine reporting some vulnerabilities related do curl:

High: CVE-2021-22901
Medium: CVE-2021-22898

Those applies to both 1.20-alpine and 1.21-alpine, didn't checked other versions.

[thresheek]

Let's wait for alpine linux base image to fix this issue. Both dont seem to be any bad for intented curl usage inside this image.

[wszydlak]

It seems that is already fixed and waiting for alpine release: https://gitlab.alpinelinux.org/alpine/aports/-/issues/12706

[patrickc91]

Looks like the Alpine base image has been updated. I think the Nginx image just needs to be rebuilt and published. This would resolve issue #553 as well I believe.

[thresheek]

Doesnt look like it was updated: https://hub.docker.com/_/alpine?tab=tags&page=1&ordering=last_updated

[patrickc91]

My bad. I guess you're right. I assumed, instead of looking, because Trivy isn't returning these CVE's when I run it against alpine:latest. But they're definitely firing off for nginx:alpine.

[wszydlak]

Hi @thresheek, alpine 3.14 has been released, could be updated in 1.21 and 1.20 also.
https://www.alpinelinux.org/posts/Alpine-3.14.0-released.html

[meldafrawi]

@thresheek I've created a PR to bump alpine version to 3.14, could you please do a review ?

[thresheek]

hi @meldafrawi it doesnt make sense yet as alpine3.14-based images cannot be built for docker library: docker-library/haproxy#163

[hamjo]

It seems like the alpine version doesn't even need to be updated. Alpine's version of curl is at 7.77. This could be fixed by building the image with apk add --upgrade --no-cache curl instead of apk add --no-cache curl

[thresheek]

Fixed in nginx:1.21.1-alpine.

Will be fixed for 1.20 images when there is a new 1.20 release (no ETA).

[wszydlak]

I can confirm, vulnerabilities from this issue are not appearing in 1.21.1-alpine scan

[thresheek]

nginx:1.20.1-alpine now ships libcurl 7.78.0-r0, so this is fixed now.