influxdata / influxdata/influxdata-docker

Critical CVE-2018-12976 found in latest docker image

Open
#704 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
364
Forks
255
Avg merge
3h 18m
Merged PRs (30d)
7

Description

I've recently downloaded the latest docker image and uploaded it to AWS' ECR which scans it for vulnerabilities. It found CVE-2018-12976

It would be nice if this was fixed.

Looking in the CVE database it seems like there was a patch released to fix this, https://nvd.nist.gov/vuln/detail/CVE-2018-12976 so I expect it can be easily remedied by updating the base o/s of the container.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Docker image definition and its base operating-system reference in this repository, then review CVE-2018-12976 in the linked NVD entry and reproduce the AWS ECR vulnerability scan if available. Done means rebuilding the affected image with a base OS or dependency version that addresses the CVE and confirming the vulnerability no longer appears.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.