repos/docker-radius
6
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Releases 2 Activity

[Snyk] Security upgrade alpine from 3.19 to 3 #1

Closed
luketainton wants to merge 1 commits from snyk-fix-1b4c25b5a806bc1d7192c82d6fbb12c3 into master
pull from: snyk-fix-1b4c25b5a806bc1d7192c82d6fbb12c3
merge into: repos:master
Conversation 0 Commits 1 Files Changed 1 +1 -1
luketainton commented 2024-06-18 21:52:13 +00:00 (Migrated from github.com)
Copy Link

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • Dockerfile

We recommend upgrading to alpine:3, as this image has only 3 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
medium severity Out-of-bounds Write
SNYK-ALPINE319-BUSYBOX-6913413		   80  
medium severity Use After Free
SNYK-ALPINE319-BUSYBOX-6928845		   80  
medium severity Use After Free
SNYK-ALPINE319-BUSYBOX-6928846		   80  
medium severity Use After Free
SNYK-ALPINE319-BUSYBOX-6928846		   80  
medium severity Use After Free
SNYK-ALPINE319-BUSYBOX-6928847		   80  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use After Free

<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br />![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123) ### Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `Dockerfile` We recommend upgrading to `alpine:3`, as this image has only **3** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Out-of-bounds Write <br/>[SNYK-ALPINE319-BUSYBOX-6913413](https://snyk.io/vuln/SNYK-ALPINE319-BUSYBOX-6913413) | &nbsp;&nbsp;**80**&nbsp;&nbsp; ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE319-BUSYBOX-6928845](https://snyk.io/vuln/SNYK-ALPINE319-BUSYBOX-6928845) | &nbsp;&nbsp;**80**&nbsp;&nbsp; ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE319-BUSYBOX-6928846](https://snyk.io/vuln/SNYK-ALPINE319-BUSYBOX-6928846) | &nbsp;&nbsp;**80**&nbsp;&nbsp; ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE319-BUSYBOX-6928846](https://snyk.io/vuln/SNYK-ALPINE319-BUSYBOX-6928846) | &nbsp;&nbsp;**80**&nbsp;&nbsp; ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Use After Free <br/>[SNYK-ALPINE319-BUSYBOX-6928847](https://snyk.io/vuln/SNYK-ALPINE319-BUSYBOX-6928847) | &nbsp;&nbsp;**80**&nbsp;&nbsp; --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiIyZWFiMTAzMC1mZjNmLTQ5NmItYjZlYy04YTI4OGUwMGZiYTEiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjJlYWIxMDMwLWZmM2YtNDk2Yi1iNmVjLThhMjg4ZTAwZmJhMSJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/luketainton/project/40c3db53-812a-4cbd-b7a7-2c776508a967?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/luketainton/project/40c3db53-812a-4cbd-b7a7-2c776508a967?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Use After Free](https://learn.snyk.io/lesson/use-after-free/?loc&#x3D;fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"alpine","from":"3.19","to":"3"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE319-BUSYBOX-6913413","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sun May 19 2024 02:17:28 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Out-of-bounds Write"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE319-BUSYBOX-6928846","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Tue May 21 2024 02:15:42 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Use After Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE319-BUSYBOX-6928847","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Tue May 21 2024 02:15:57 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Use After Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE319-BUSYBOX-6928845","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Tue May 21 2024 02:15:39 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Use After Free"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE319-BUSYBOX-6928846","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Tue May 21 2024 02:15:42 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Use After Free"}],"prId":"2eab1030-ff3f-496b-b6ec-8a288e00fba1","prPublicId":"2eab1030-ff3f-496b-b6ec-8a288e00fba1","packageManager":"dockerfile","priorityScoreList":[80,80,80,80],"projectPublicId":"40c3db53-812a-4cbd-b7a7-2c776508a967","projectUrl":"https://app.snyk.io/org/luketainton/project/40c3db53-812a-4cbd-b7a7-2c776508a967?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE319-BUSYBOX-6913413","SNYK-ALPINE319-BUSYBOX-6928845","SNYK-ALPINE319-BUSYBOX-6928846","SNYK-ALPINE319-BUSYBOX-6928846","SNYK-ALPINE319-BUSYBOX-6928847"],"vulns":["SNYK-ALPINE319-BUSYBOX-6913413","SNYK-ALPINE319-BUSYBOX-6928846","SNYK-ALPINE319-BUSYBOX-6928847","SNYK-ALPINE319-BUSYBOX-6928845"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
The priority is critical
Priority
High
The priority is high
Priority
Low
The priority is low
Priority
Medium
The priority is medium
Reviewed
Confirmed
Issue has been confirmed
Reviewed
Duplicate
This issue or pull request already exists
Reviewed
Invalid
Invalid issue
Reviewed
Won't Fix
This issue won't be fixed
Status
Abandoned
Somebody has started to work on this but abandoned work
Status
Blocked
Something is blocking this issue or pull request
Status
Need More Info
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
Alexander.Lyall ai-review-bot flows-bot gitea-actions-bot luke renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: repos/docker-radius#1
Delete Branch "snyk-fix-1b4c25b5a806bc1d7192c82d6fbb12c3"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?