nodejs/npm update for nodejs-20-minimal
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, nodejs
- Domain
- devops, infrastructure, security
Research direction
Start with the UBI9 nodejs-20-minimal image definition and its package/version inputs, then compare the reported nodejs-20-minimal:1-37.1712566503 image with the requested Node.js 20.12.x and npm 10.5.0 versions. Rebuild the image and run the documented Twistlock/Prisma scan; done means the vulnerable ip package is no longer reported.
Written by the indexing model from the issue text.
Description
Container platform
OCP 4
Version
ubi9/nodejs-20-minimal:1-37.1712566503
OS version of the container image
RHEL 9
Bugzilla, Jira
No response
Description
npm packaged in this image depends on vulnerable ip package - CVE-2023-42282 and apps built with this base image gets flagged out in scanners with critical vulnerability. Though the vulnerable code is never called by npm, we could not convince audit.
npm v10.5.0 / nodejs v20.12.0 includes fixes for this vulnerability.
Are there plans to upgrade node package to 20.12.x? Or would you recommend us install node 20.12.x on ubi9/minimal base image?
Reproducer
- Build a nodejs app with ubi9/nodejs-20-minimal:1-37.1712566503
- Scan the built image with twistlock/prisma
- Reports critical vulnerability in the built image
- Dominant language
- Shell
- Stars
- 173
- Forks
- 288
- Avg merge
- 6d 1h
- Merged PRs (30d)
- 1
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from sclorg/s2i-nodejs-container
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
sclorg/s2i-nodejs-container#542 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
sclorg/s2i-nodejs-container#525 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 48/100
sclorg/s2i-nodejs-container#519 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
sclorg/s2i-nodejs-container#505 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
sclorg/s2i-nodejs-container#472 ·
All issues in sclorg/s2i-nodejs-container
Similar issues
-
Update Vish to 1.1.5 Openpackage-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
oSoWoSo/vOid_Community_repOsitory#144 · 1 comment ·
-
help wanted new command
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
tldr-pages/tldr#24151 ·
-
PacReq: Rune IDE Openpackage request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pacstall/pacstall-programs#9402 ·
-
[BUG] ci: the first prefetch-images.sh call runs before shard.txt exists, so it is always a no-op Openbug github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
update-request
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
msys2/MINGW-packages#31768 ·