Official-images: Update Debian with 4.19.171-2

[SurajChande]

Problem - We are not able to use the node buster images (specifically 14.15.4-buster) due to sec vulnerabilities

Would be great if the buster images are updated with the latest version of Debian which has security fixes.
https://tracker.debian.org/news/1226431/accepted-linux-419171-2-source-into-stable-embargoed-stable/

[tianon]

This is very similar to https://github.com/debuerreotype/docker-debian-artifacts/issues/114 -- Docker images do not contain the Linux kernel (the kernel of the host is shared with container instances).

That being said, Debian is going to have a release on Saturday, and thus a rebuild of Debian (and child) images is already planned for early next week.

[tianon]

See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves for more information about CVEs generally.

[SurajChande]

Thanks! In our case, we are using node buster image as a base then apt-get to build an included cypress image which is failing in Twistlock scan. I will try again next week with an updated node image with the latest version of Debian buster 🤞

[tianon]

I mean, any kernel vulnerability is a false positive for a container, so
this is definitely a false positive and I'd suggest reporting it to them
too.