Official-images: CVE-2020-29362/3 for Python images

[dinvlad]

Recent aquasec/trivy scans reveal that at least some Python images (e.g. python:slim) have critical CVEs in libpkt11-kit0:

|   LIBRARY   | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |   FIXED VERSION   |                 TITLE                 |
+-------------+------------------+----------+-------------------+-------------------+---------------------------------------+
| libp11-kit0 | CVE-2020-29362   | CRITICAL | 0.23.15-2         | 0.23.15-2+deb10u1 | p11-kit: out-of-bounds read in        |
|             |                  |          |                   |                   | p11_rpc_buffer_get_byte_array         |
|             |                  |          |                   |                   | function in rpc-message.c             |
|             |                  |          |                   |                   | -->avd.aquasec.com/nvd/cve-2020-29362 |
+             +------------------+          +                   +                   +---------------------------------------+
|             | CVE-2020-29363   |          |                   |                   | p11-kit: out-of-bounds write in       |
|             |                  |          |                   |                   | p11_rpc_buffer_get_byte_array_value   |
|             |                  |          |                   |                   | function in rpc-message.c             |
|             |                  |          |                   |                   | -->avd.aquasec.com/nvd/cve-2020-29363 |
+-------------+------------------+----------+-------------------+-------------------+---------------------------------------+

Could you please update these?
Thanks

[wglambert]

https://security-tracker.debian.org/tracker/CVE-2020-29362
https://security-tracker.debian.org/tracker/CVE-2020-29363
Buster is unfixed so there's nothing actionable for us to do
It's fixed in the Buster-Security repo

$ docker run -it --rm python:slim bash
root@5ae13ca28309:/# apt update && apt list --upgradeable
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://security.debian.org/debian-security buster/updates/main amd64 Packages [260 kB]
Get:3 http://deb.debian.org/debian buster InRelease [121 kB]
Get:4 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7907 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [7860 B]
Fetched 8414 kB in 2s (3921 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
2 packages can be upgraded. Run 'apt list --upgradable' to see them.
Listing... Done
libp11-kit0/stable 0.23.15-2+deb10u1 amd64 [upgradable from: 0.23.15-2]
tzdata/stable-updates 2020e-0+deb10u1 all [upgradable from: 2020d-0+deb10u1]

Also see https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves
And https://github.com/docker-library/postgres/issues/286#issuecomment-302512767 docker-library/openjdk#161, docker-library/openjdk#112, docker-library/postgres#286, docker-library/drupal#84, docker-library/official-images#2740, docker-library/ruby#117, docker-library/ruby#94, docker-library/python#152, docker-library/php#242, docker-library/buildpack-deps#46, docker-library/openjdk#185.

A CVE doesn't imply having an actual vulnerability, and often is even a false positive (given how most distributions handle versioning/security updates in stable releases). If there are actionable items we can resolve, we're happy to do so (and do so actively). We update all Debian based images to include any updates in apt packages at least monthly (we regenerate the base images and then rebuild all dependent images).

[yosifkit]

https://github.com/debuerreotype/docker-debian-artifacts/issues/111#issuecomment-754265189

[dinvlad]

@wglambert thanks for clarification! The reason we're asking to patch these is because we have regular compliance checks, and those require Criticals to be addressed within 2 weeks, no matter if they're FPs or not :/ So if you could apply the relevant patches without major effort, that would be highly welcome! Otherwise, we (and many others probably) have to either patch it on our end, or switch to a different base, for now..

Alternatively, if the base Debian image update happens within a week or so as @yosifkit mentioned, that's workable too!

[dinvlad]

Looks like apt-get update && apt-get upgrade -y is a good enough workaround for now though, thanks @wglambert!

[tianon]

Closing in favor of debuerreotype/docker-debian-artifacts#111, which is a more specific place to track this update.