hashicorp / hashicorp/consul

The latest version uses vulnerable Alpine version as a base

Open
#21,654 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

The latest version of hashicorp/consul (v1.19.2) is using vulnerable Alpine version as a base (3.19):
CVE-2024-6197,
CVE-2024-2466,
CVE-2024-2398,
CVE-2024-0853,

This affects our commercial project's security scanning because we pull this image.
Could you please use the more generic version of Alpine in the Dockerfile - as like as hashicorp/vault does: https://github.com/hashicorp/vault/blob/c91c85442144e1228c02123fc4b19337f7d52700/Dockerfile#L5
This Vault's change has solved the issues for us.

Thanks

Contributor guide

Open the contributing guide

Research direction

Start by locating Consul's Dockerfile and compare its Alpine base image reference with the Vault Dockerfile linked in the issue. Update the base-image reference to the more generic Alpine form requested, then build or scan the resulting image and confirm the reported vulnerabilities are addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.