fluent/fluentd:v1.11-debian-1 security issues

[sebastianmacarescu]

Scanning fluent/fluentd:v1.11-debian-1 with AWS ECR Image scanning yields the following vulnerabilities:

• 2 critical: CVE-2019-19816, CVE-2019-19814
• 7 high: CVE-2013-7445, CVE-2019-19815, CVE-2020-13974, CVE-2019-19074, CVE-2020-12464, CVE-2019-19813, CVE-2020-10878

Most of them are related to linux:4.19.118-2 package.

[KlavsKlavsen]

and that package should NOT be installed AFAIK - atleast after build it should not be necessary (its not like docker instances run their own kernel :)

[flomontl]

Is there a plan to upgrade and fix these CVEs please?

[g3kr]

@sebastianmacarescu were you able to fix this?

[repeatedly]

What is the best base image for debian ruby?
Currently, we use ruby:2.6-slim-buster. Should be upgraded to ruby:2.7-slim-buster ?

[sebastianmacarescu]

@g3kr No, not yet.