The image contains 4 high vulnerabilitiesDocker DX (docker-language-server)(critical_high_vulnerabilities)
- Dominant language
- C
- Stars
- 4.8k
- Forks
- 523
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 9
Description
**Describe the bug**
The Docker image `apache/age:release_PG17_1.6.0` contains 4 high security vulnerabilities, which poses a security risk when used in production environments.
**How are you accessing AGE (Command line, driver, etc.)?**
- Docker image
**What data setup do we need to do?**
N/A - This is a base image security issue, not related to data setup.
**What is the necessary configuration info needed?**
- Using the official Apache AGE Docker image: `apache/age:release_PG17_1.6.0`
- Docker image scanning reveals: 0 Critical, 4 High, 9 Medium, 29 Low vulnerabilities
**What is the command that caused the error?**
```dockerfile
FROM apache/age:release_PG17_1.6.0
```
When scanning the image with Docker security tools, the following vulnerabilities are detected:
```
Current image vulnerabilities: 0C 4H 9M 29L
```
**Expected behavior**
The base Docker image should be regularly updated to patch known security vulnerabilities. The image should have minimal or no high-severity vulnerabilities, especially for production use.
**Environment (please complete the following information):**
- Version: `apache/age:release_PG17_1.6.0`
- PostgreSQL Version: 17
- AGE Version: 1.6.0
**Additional context**
This issue affects anyone using the official Apache AGE Docker image as a base image. The vulnerabilities should be addressed by:
1. Updating base packages in the image
2. Rebuilding and publishing a new image version with security patches
3. Providing regular security updates for the Docker image
The Dockerfile in question:
```dockerfile
FROM apache/age:release_PG17_1.6.0
ARG PG_MAJOR=17
ADD https://github.com/pgvector/pgvector.git#v0.8.1 /tmp/pgvector
RUN apt-get update && \
apt-mark hold locales && \
apt-get install -y --no-install-recommends build-essential postgresql-server-dev-$PG_MAJOR && \
cd /tmp/pgvector && \
make clean && \
make OPTFLAGS="" && \
make install && \
mkdir /usr/share/doc/pgvector && \
cp LICENSE README.md /usr/share/doc/pgvector && \
rm -r /tmp/pgvector && \
apt-get remove -y build-essential postgresql-server-dev-$PG_MAJOR && \
apt-get autoremove -y && \
apt-mark unhold locales && \
rm -rf /var/lib/apt/lists/*
```
Contributor guide
Assessment
This issue has not been assessed yet.