From 6cfab3e5633c71562fc285661b9534b84f0bce16 Mon Sep 17 00:00:00 2001 From: Nicolas Favre-Felix Date: Mon, 29 Mar 2021 20:11:35 -0700 Subject: [PATCH] Update base image to Alpine 3.12.5 Alpine 3.12.4 uses a vulnerable version of libssl1.1 (CVE-2021-3449 and CVE-2021-3450), issues that are fixed in Alpine 3.12.5. This is not really a problem for Webdis since it doesn't use SSL, but the vulnerability shows up on image scans and users who build images with Webdis as the base image could be at risk if their own changes depend on this library. --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 7be79c1..2d7e954 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.12.4 AS stage +FROM alpine:3.12.5 AS stage LABEL maintainer="Nicolas Favre-Felix " RUN apk update && apk add wget make gcc libevent-dev msgpack-c-dev musl-dev bsd-compat-headers jq @@ -9,7 +9,7 @@ RUN cd webdis-$(cat latest) && make && make install && cd .. RUN sed -i -e 's/"daemonize":.*true,/"daemonize": false,/g' /etc/webdis.prod.json # main image -FROM alpine:3.12.4 +FROM alpine:3.12.5 RUN apk update && apk add libevent msgpack-c redis # Required dependencies RUN apk add libcrypto1.1 # Security updates COPY --from=stage /usr/local/bin/webdis /usr/local/bin/