Dotnet-docker: CVE-2019-18224 vulnerability in mcr.microsoft.com/dotnet/core/aspnet:3.1.1-buster-slim
Steps to reproduce the issue
1.When scanning the mcr.microsoft.com/dotnet/core/aspnet:3.1.1-buster-slim docker image, we find the following CVE which appears to have a vendor fix (https://security-tracker.debian.org/tracker/CVE-2019-18224)
Could you please update the docker image with buster (security)
Expected behavior
No high severity found
Actual behavior
1 high severity found
passuied
All 10 comments
This issue should be logged against the debian base images. The debian:buster-slim image is where the libidn2 package comes from.
$ docker run -it --rm debian:buster-slim apt list libidn*
Listing... Done
libidn2-0/now 2.0.5-1 amd64 [installed,local]
The patched version appears available.
$ docker run -it --rm debian:buster-slim
root@d4017a4a6b27:/# apt-get update
Get:2 http://deb.debian.org/debian buster InRelease [122 kB]
Get:1 http://security-cdn.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [49.3 kB]
Get:4 http://deb.debian.org/debian buster/main amd64 Packages [7908 kB]
Get:5 http://security-cdn.debian.org/debian-security buster/updates/main amd64 Packages [175 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [5792 B]
Fetched 8325 kB in 3s (2518 kB/s)
Reading package lists... Done
root@d4017a4a6b27:/# apt list --upgradable
Listing... Done
libidn2-0/stable 2.0.5-1+deb10u1 amd64 [upgradable from: 2.0.5-1]
N: There is 1 additional version. Please use the '-a' switch to see it
Once the base image is updated, the .NET Core images will get automatically rebuild.
A temporary workaround would be to upgrade the package in your Docker layers.
MichaelSimons
on 4 Feb 2020
Thanks, created issue: https://github.com/debuerreotype/docker-debian-artifacts/issues/85
passuied
on 5 Feb 2020
Quick question - when the images are rebuilt - are they published with the same tag? i.e. if I use 3.1.2 now once it rebuilds and we rebuild the docker image the fix should be in?
phouri
on 23 Feb 2020
I have the same question. We have checked and 3.1.2 definitely doesn't have
the fix
On Sun, Feb 23, 2020, 08:01 Pini Houri notifications@github.com wrote:
Quick question - when the images are rebuilt - are they published with the
same tag? i.e. if I use 3.1.2 now once it rebuilds and we rebuild the
docker image the fix should be in?—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/dotnet/dotnet-docker/issues/1656?email_source=notifications&email_token=AAHV5BSKIA2MHK3WKSBPOBTREKMVZA5CNFSM4KP43SIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMV7PHA#issuecomment-590083996,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAHV5BTZBSTWPYWH4YELGLDREKMVZANCNFSM4KP43SIA
.
passuied
on 23 Feb 2020
Yes, the existing 3.1.2 tag will be updated each time that version of the image gets rebuilt due to a base image change. When a base image is updated (e.g. debian:buster-slim), only the images for the most recent supported patch release of .NET Core get rebuilt. At the time of this comment, the most recent patch release for .NET Core 3.1 is 3.1.2 so the 3.1.2 tags would be updated up until a newer .NET Core patch release is made available. Similarly for 2.1 and 3.0.
mthalman
on 24 Feb 2020
https://github.com/docker-library/official-images/pull/7518 since debian is updated (and new images are in place it seems) - can probably close this issue
phouri
on 26 Feb 2020
Have the dotnet images now been updated? How do you know that they have
...? Seems like the version doesn't necessarily change
On Wed, Feb 26, 2020, 03:23 Pini Houri notifications@github.com wrote:
docker-library/official-images#7518
https://github.com/docker-library/official-images/pull/7518 since
debian is updated (and new images are in place it seems) - can probably
close this issue—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/dotnet/dotnet-docker/issues/1656?email_source=notifications&email_token=AAHV5BTN5WEBZ7AIQUSYRR3REZGLVA5CNFSM4KP43SIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEM73HUA#issuecomment-591377360,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAHV5BTVTLRLJSMC2A47ELDREZGLVANCNFSM4KP43SIA
.
passuied
on 26 Feb 2020
Yea they have, delete your images locally and run the same command above with the .net images, also look at docker hub on change date
From: passuied notifications@github.com
Sent: Wednesday, February 26, 2020 3:53:34 PM
To: dotnet/dotnet-docker dotnet-docker@noreply.github.com
Cc: Pini Houri pinhasph@gmail.com; Manual manual@noreply.github.com
Subject: Re: [dotnet/dotnet-docker] CVE-2019-18224 vulnerability in mcr.microsoft.com/dotnet/core/aspnet:3.1.1-buster-slim (#1656)
Have the dotnet images now been updated? How do you know that they have
...? Seems like the version doesn't necessarily change
On Wed, Feb 26, 2020, 03:23 Pini Houri notifications@github.com wrote:
docker-library/official-images#7518
https://github.com/docker-library/official-images/pull/7518 since
debian is updated (and new images are in place it seems) - can probably
close this issue—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/dotnet/dotnet-docker/issues/1656?email_source=notifications&email_token=AAHV5BTN5WEBZ7AIQUSYRR3REZGLVA5CNFSM4KP43SIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEM73HUA#issuecomment-591377360,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAHV5BTVTLRLJSMC2A47ELDREZGLVANCNFSM4KP43SIA
.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHubhttps://github.com/dotnet/dotnet-docker/issues/1656?email_source=notifications&email_token=ABHPBIXQCWM4B2B5BWGQGILREZX55A5CNFSM4KP43SIKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENAJYJQ#issuecomment-591436838, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABHPBIS3V7WU77M7L55KJELREZX55ANCNFSM4KP43SIA.
phouri
on 26 Feb 2020
Have the dotnet images now been updated? How do you know that they have ...? Seems like the version doesn't necessarily change
The versions don't change because it's the same version of .NET Core installed. We just rebuild the image to pick up the latest base image.
mthalman
on 26 Feb 2020
Closing - the .NET images have been rebuilt with the updated base images.
MichaelSimons
on 26 Feb 2020
Related issues
tonysedniov
·
6Comments
natemcmaster
·
5Comments
mthalman
·
6Comments
twhittakeriq
·
5Comments
cypressious
·
5Comments
Most helpful comment
Yes, the existing 3.1.2 tag will be updated each time that version of the image gets rebuilt due to a base image change. When a base image is updated (e.g.
debian:buster-slim), only the images for the most recent supported patch release of .NET Core get rebuilt. At the time of this comment, the most recent patch release for .NET Core 3.1 is 3.1.2 so the 3.1.2 tags would be updated up until a newer .NET Core patch release is made available. Similarly for 2.1 and 3.0.