influxdata / influxdata/influxdata-docker
Critical CVE-2018-12976 found in latest docker image
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 364
- Forks
- 255
- Avg merge
- 3h 18m
- Merged PRs (30d)
- 7
Description
I've recently downloaded the latest docker image and uploaded it to AWS' ECR which scans it for vulnerabilities. It found CVE-2018-12976
It would be nice if this was fixed.
Looking in the CVE database it seems like there was a patch released to fix this, https://nvd.nist.gov/vuln/detail/CVE-2018-12976 so I expect it can be easily remedied by updating the base o/s of the container.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Docker image definition and its base operating-system reference in this repository, then review CVE-2018-12976 in the linked NVD entry and reproduce the AWS ECR vulnerability scan if available. Done means rebuilding the affected image with a base OS or dependency version that addresses the CVE and confirming the vulnerability no longer appears.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100