The latest version uses vulnerable Alpine version as a base
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
The latest version of hashicorp/consul (v1.19.2) is using vulnerable Alpine version as a base (3.19):
CVE-2024-6197,
CVE-2024-2466,
CVE-2024-2398,
CVE-2024-0853,
This affects our commercial project's security scanning because we pull this image.
Could you please use the more generic version of Alpine in the Dockerfile - as like as hashicorp/vault does: https://github.com/hashicorp/vault/blob/c91c85442144e1228c02123fc4b19337f7d52700/Dockerfile#L5
This Vault's change has solved the issues for us.
Thanks
Contributor guide
Research direction
Start by locating Consul's Dockerfile and compare its Alpine base image reference with the Vault Dockerfile linked in the issue. Update the base-image reference to the more generic Alpine form requested, then build or scan the resulting image and confirm the reported vulnerabilities are addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100