Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security patches of known vulnerabilities in docker image #270

Merged
merged 2 commits into from
Oct 19, 2020
Merged

Security patches of known vulnerabilities in docker image #270

merged 2 commits into from
Oct 19, 2020

Conversation

wongannaw
Copy link
Contributor

Supports #269

Running trivy image --ignore-unfixed --light annas-cool-image:latestt > fixed.txt (ignore the extra "t" I know how to spell) results in fixed.txt output:

2020-10-19T10:21:21.830-0500	�[34mINFO�[0m	Detecting Alpine vulnerabilities...
2020-10-19T10:21:21.831-0500	�[34mINFO�[0m	Detecting nodejs vulnerabilities...

annas-cool-image:latestt (alpine 3.11.6)
========================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


srv/configurable-http-proxy/package-lock.json
=============================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

@welcome
Copy link

welcome bot commented Oct 19, 2020

Thanks for submitting your first pull request! You are awesome! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please make sure you followed the pull request template, as this will help us review your contribution more quickly.
welcome
You can meet the other Jovyans by joining our Discourse forum. There is also a intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

meneal
meneal reviewed Oct 19, 2020
View reviewed changes
Copy link

@meneal meneal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few small comments.

consideRatio
consideRatio requested changes Oct 19, 2020
View reviewed changes
@wongannaw
upgrades to latest alpine
a6d0bb9 
fixes whitespace
@wongannaw wongannaw force-pushed the proxy-img-lib-patch branch from 24cd3f0 to a6d0bb9 Compare October 19, 2020 16:38
@consideRatio
Copy link
Member

consideRatio commented Oct 19, 2020 •
edited
Loading

Thank you for your work to notice this, attempt to patch it, and verify the patch to be successful @wongannaw ❤️ 🎉! Thank you for the review work @meneal! ❤️ 🎉

consideRatio
consideRatio approved these changes Oct 19, 2020
View reviewed changes
Copy link
Member

@consideRatio consideRatio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@wongannaw verified that the bump of alpine did the trick to resolve the detected vulnerabilities.

Also note that according to https://nodejs.org/en/, LTS = Long Term Support version, is currently 12.19.0.

@consideRatio consideRatio changed the title patches image vulnerability with lib upgrade Security patches of known vulnerabilities in docker image Oct 19, 2020
@consideRatio consideRatio merged commit 931cfe2 into jupyterhub:master Oct 19, 2020
@welcome
Copy link

welcome bot commented Oct 19, 2020

Congrats on your first merged pull request in this project! 🎉
congrats
Thank you for contributing, we are very proud of you! ❤️

@wongannaw wongannaw deleted the proxy-img-lib-patch branch October 19, 2020 17:25
@wongannaw wongannaw mentioned this pull request Oct 19, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@meneal meneal meneal left review comments

@consideRatio consideRatio consideRatio approved these changes

Assignees
No one assigned
Labels
maintenance
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@wongannaw @consideRatio @meneal