Azure / Azure/azure-quickstart-templates

Ubuntu VM with Docker is causing Advisor to report critical security vulnerabilities

Open
#12,165 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Bicep
Stars
14.9k
Forks
16.2k
Avg merge
6d 21h
Merged PRs (30d)
6

Description

[Simple deployment of an Ubuntu VM with Docker](https://github.com/Azure/azure-quickstart-templates/tree/master/application-workloads/docker/docker-simple-on-ubuntu)

### Issue Details

The template is causing Advisor to report over 30 critical vulnerabilities, mostly surrounding certificates. My assumption is that this image should come with all the required certificates configured, and when ssh'ing into the VM and looking around I can see many, many certificates are installed, so at this point I'm unsure whether:
- I need to implement certificates that the template doesn't provide
- Advisor is incorrect
- The certificates that come with the template aren't configured correctly

Some clarity here would be greatly appreciated. Screenshot with some of the vulnerabilities is attached.

![security_vulnerabilities](https://user-images.githubusercontent.com/7558545/153250573-e15f0963-5d5c-4a6a-9076-d04206bb193f.png)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the application-workloads/docker/docker-simple-on-ubuntu template and reproduce the Azure Advisor findings for a deployed Ubuntu VM with Docker. Compare the reported certificate vulnerabilities with the certificates and configuration present in the VM, then document whether the template, its certificate setup, or Advisor is responsible.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, ubuntu
Domain
cloud, devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.