Skip to content

Updated base image with vulnerability patches.

Daniel Scholl requested to merge vulnerabilities into main

Feature: Enhance Process by adding make file, support multi-arch and added Changelogs.

Fix: Resolve vulnerabilities in Docker image and Java dependencies

This PR highlights the vulnerabilities that have been resolved in the Docker image and associated Java dependencies. Below is the delta of vulnerabilities that were present in the previous scan but are no longer found in the current state.

Resolved Vulnerabilities:

Docker Image (alpine 3.13.12)

  1. busybox

    • Vulnerability: CVE-2022-48174
    • Severity: Critical
    • Issue: Stack overflow vulnerability in ash.c leads to arbitrary code execution.
    • Resolution: Upgraded from 1.32.1-r9 to 1.36.1-r2.
  2. busybox

    • Multiple high and medium vulnerabilities related to use-after-free and out-of-bounds read/write issues in various awk applet versions.
    • Resolved via image upgrade.
  3. OS Version

    • Upgraded from unsupported alpine 3.13.12 to alpine 3.19.4, ensuring continued security updates and reduced vulnerabilities.

Java Dependencies

  1. com.azure:azure-identity

    • Vulnerability: CVE-2024-35255
    • Severity: Medium
    • Issue: Elevation of privilege vulnerability in Azure Identity libraries.
    • Resolution: Upgraded from 1.12.0 to 1.12.2.
  2. com.microsoft.azure:msal4j

    • Addressed minor vulnerabilities and improved stability by upgrading from 1.15.0 to 1.15.1.
  3. io.netty:netty-common

    • Vulnerability: CVE-2024-47535
    • Severity: Medium
    • Issue: Denial of Service attack on Windows apps using Netty.
    • Resolution: Upgraded from 4.1.109.Final to 4.1.115.

By resolving these vulnerabilities, the project achieves enhanced security, improved stability, and alignment with the latest software and OS updates. Please review and approve this PR.

Merge request reports

Loading