traefik:v2.6.6 security issues
pogoma opened this issue · comments
I'm using this traefik docker image: traefik:v2.6.6
Currently this is the latest build available. But this image is getting flagged in my scan for having these vulnerabilies related to busybox CVE-2022-28391, CVE-2021-42376 (to fix this Busybox version needs to be higher than 1.35.0)
Hello,
the builds of the official Docker image are handled by Docker itself.
When they detect CVE on a layer, they rebuild all the official images.
https://github.com/docker-library/official-images
I will update the version of alpine.
Sorry, it was false-positve. Version of busybox in image is 1.33.1-r7 (which is patched), my scan ignored pkgrel and recognized version 1.33.1 (which is vulnerable)