rust-lang / rust-lang/docker-rust

docker-rust image in dockerhub (1.64.0-slim-bullseye) has 2 Critical Vulnerabilities

Open
#117 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Dockerfile
Stars
537
Forks
111
Avg merge
1d 38m
Merged PRs (30d)
4

Description

│ libarchive13 │ CVE-2022-26280 │ CRITICAL │ 3.4.3-2+deb11u1 │ │ libarchive: an out-of-bounds read via the component │
│ │ │ │ │ │ zipx_lzma_alone_init │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-26280

───────────────────────────────────────────────┤
│ libdb5.3 │ CVE-2019-8457 │ CRITICAL │ 5.3.28+dfsg1-0.8 │ │ sqlite: heap out-of-bound read in function rtreenode() │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-8457

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting how the 1.64.0-slim-bullseye image is built and how its Debian packages are selected, then verify the reported libarchive13 and libdb5.3 vulnerabilities against the image. Done means the image is rebuilt with those critical vulnerabilities addressed and the vulnerability scan no longer reports them.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, rust
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.