bazelbuild / bazelbuild/rules_docker
Outdated distroless base image version has many CVEs
- Dominant language
- Starlark
- Stars
- 1.1k
- Forks
- 689
- PR merge metrics
- No merged PRs in 30d
Description
# 🐞 bug report
### Affected Rule
The issue affects `go_image`, `cc_image` and probably other `*_image`s.
### Is this a regression?
Not really.
### Description
The current release v0.25.0 references old versions of distroless base images (2021-12). Users who are building off the default base images are inadvertently using 1+ year old distroless that contain many CVEs. Specifically, this affects users who are copy-pasting
```
load(
"@io_bazel_rules_docker//go:image.bzl",
_go_image_repos = "repositories",
)
_go_image_repos()
```
And not specifying a `base = ...` in their `go_image`.
Please release a new version of `rules_docker` with updated the distroless image version.
Alternatively, remove `repositories()` from `go:image.bzl` and others. This will mean that users will have to explicitly specify a `base` image/version.
## 🔬 Minimal Reproduction
1. Follow the instructions on https://github.com/bazelbuild/rules_docker#go_image to build a `go_image` without specifying a `base = ...`
2. Upload the `go_image` to Google Container Repository.
## 🔥 Exception or Error
Google Container Repository reports the following CVEs:
[CVE-2022-1292 ](https://security-tracker.debian.org/tracker/CVE-2022-1292) Critical 10 Yes openssl OS
[CVE-2022-2068 ](https://security-tracker.debian.org/tracker/CVE-2022-2068) Critical 10 Yes openssl OS
[CVE-2022-23219 ](https://security-tracker.debian.org/tracker/CVE-2022-23219) High 7.5 Yes glibc OS
[CVE-2021-3999 ](https://security-tracker.debian.org/tracker/CVE-2021-3999) High 7.8 Yes glibc OS
[CVE-2021-33574 ](https://security-tracker.debian.org/tracker/CVE-2021-33574) High 7.5 Yes glibc OS
[CVE-2022-23218 ](https://security-tracker.debian.org/tracker/CVE-2022-23218) High 7.5 Yes glibc OS
[CVE-2021-4160 ](https://security-tracker.debian.org/tracker/CVE-2021-4160) Medium 4.3 Yes openssl OS
[CVE-2022-2097 ](https://security-tracker.debian.org/tracker/CVE-2022-2097) Medium 5 – openssl OS
[CVE-2022-0778 ](https://security-tracker.debian.org/tracker/CVE-2022-0778) Medium 5 Yes openssl OS
[CVE-2019-1010023 ](https://security-tracker.debian.org/tracker/CVE-2019-1010023) Low 6.8 – glibc OS
[CVE-2021-43396 ](https://security-tracker.debian.org/tracker/CVE-2021-43396) Low 5 Yes glibc OS
[CVE-2019-1010022 ](https://security-tracker.debian.org/tracker/CVE-2019-1010022) Low 7.5 – glibc OS
[CVE-2018-20796 ](https://security-tracker.debian.org/tracker/CVE-2018-20796) Low 5 – glibc OS
[CVE-2010-0928 ](https://security-tracker.debian.org/tracker/CVE-2010-0928) Low 4 – openssl OS
[CVE-2007-6755 ](https://security-tracker.debian.org/tracker/CVE-2007-6755) Low 5.8 – openssl OS
[CVE-2019-9192 ](https://security-tracker.debian.org/tracker/CVE-2019-9192) Low 5 – glibc OS
[CVE-2010-4756 ](https://security-tracker.debian.org/tracker/CVE-2010-4756) Low 4 – glibc OS
[CVE-2019-1010024 ](https://security-tracker.debian.org/tracker/CVE-2019-1010024) Low 5 – glibc OS
[CVE-2019-1010025 ](https://security-tracker.debian.org/tracker/CVE-2019-1010025) Low 5 – glibc OS
## 🌍 Your Environment
**Operating System:**
N/A
**Output of `bazel version`:**
N/A
**Rules_docker version:**
v0.25.0 -- latest as of 2023-01-04
**Anything else relevant?**
Contributor guide
Assessment
This issue has not been assessed yet.