Base image alpine:3.20.0 is vulnerable (fixed in latest packages)
OlgasAcc opened this issue · comments
Hello,
Due to the fact that alpine:3.20.0 has a few known vulnerabilities - e.g. CVE-2023-42364, CVE-2023-42365 etc.
-
they affect our security scans when we pull Ekuiper on our platform).
Is it possible for you to use more dynamic version of alpine in your Dockerfile? "FROM alpine:3.20" instead of "FROM alpine:3.20.0". Alpine team is regularly solving a new coming vulnerabilities by adding new packages to the same major version, so it will automatically pick up all the necessary security fixes for you (and inherently - for us). -
eKuiper version 1.14.1
Thanks
@ngjaying and additional question: is it possible to upgrade the github.com/gorilla/schema v1.2.0 to v1.4.1 in your go.mod? This is the vulnerability CVE-2024-37298 of high severity
Thanks