Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rebuild Docker image to update dependencies #383

Closed
ngosang opened this issue May 2, 2024 · 1 comment
Closed

Rebuild Docker image to update dependencies #383

ngosang opened this issue May 2, 2024 · 1 comment
Assignees
Labels
dependencies Pull requests that update a dependency file

Comments

@ngosang
Copy link

ngosang commented May 2, 2024

I was doing a security scanner using Grype => https://github.com/anchore/grype
And I detected your Docker image has some outdated dependencies. I don't think they are a security risk but it's a good practice to publish releases more often. Thank you for your work!

Docker image: fmartinou/whats-up-docker:6.3.0
busybox              1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical  
busybox-binsh        1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical  
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20211202192323-5770296d904e  go-module  GHSA-gwc9-m7rh-j2ww  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20200220183623-bac4c82f6975  go-module  GHSA-ffhg-7mh4-33c4  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20200124225646-8b5121be2f68  go-module  GHSA-cjjc-xp8v-855w  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20220314234659-1baeb1ce4c0b  go-module  GHSA-8c26-wmh5-6g9v  High      
golang.org/x/crypto  v0.0.0-20170503145823-04eae0b62fea  0.0.0-20201216223049-8b5274cf687f  go-module  GHSA-3vm4-22fp-5rfm  High      
libcrypto3           3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
libssl3              3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
openssl              3.1.1-r1                            3.1.4-r0                           apk        CVE-2023-5363        High      
ssl_client           1.36.1-r0                           1.36.1-r1                          apk        CVE-2022-48174       Critical 
@fmartinou fmartinou self-assigned this May 4, 2024
@fmartinou fmartinou added the dependencies Pull requests that update a dependency file label May 4, 2024
@fmartinou
Copy link
Owner

Thanks for the recommendation :)

There is now a newer 6.4.0 version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

No branches or pull requests

2 participants