[Security] Docker image doesn't install Debian security updates at build time
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Start with app/Dockerfile and inspect the runtime stage’s package installation commands. Add the suggested upgrade step and build the image to check that the Dockerfile succeeds. Done means the runtime image upgrades existing Debian packages during the build.
Written by the indexing model from the issue text.
Description
Summary
The runtime stage of app/Dockerfile installs packages without upgrading the base image's existing ones. So any Debian security fix released since the python:3.11 base image was built is missing from the published image.
Amazon Inspector findings on brainthee/chaotica:latest (linux/amd64 sha256:70d5baf8…e4ad5f):
| Package | Current | Fixed in | Finding | Public exploit |
|---|---|---|---|---|
| libbrotli1 | 1.0.9-2 | 1.0.9-2+deb12u1 | CVE-2026-111497 (CRITICAL) | Yes |
| curl | 7.88.1 | No fix yet | CVE-2026-86414 (CRITICAL) | No |
Suggested fix
RUN apt-get update --fix-missing \
+ && apt-get upgrade -y --no-install-recommends \
&& apt-get install -y --no-install-recommends \
Rebuilding the image regularly, even without code changes, would keep it current between releases. A weekly scheduled CI build would do this.
- Dominant language
- HTML
- Stars
- 6
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from brainthee/CHAOTICA
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
[Minor UI Bug] Client page shows account manager photos as squares overlapping the round borderOpen
Difficulty 1/5 Under an hour Newbie friendliness 94/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
All issues in brainthee/CHAOTICA
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
HarperFast/skills#147 ·
Maintainers usually reply within 2 days
-
area-infrastructure
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
dotnet/aspnetcore#70524 · 1 comment ·
Maintainers usually reply within 1 day
-
area:evals area:infra enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
jse-avl/support-bot#4 · 1 comment ·
-
area/installation kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
vllm-project/aibrix#3456 · 1 comment ·
Maintainers usually reply within 1 day
-
Same-repo PRs never get the required appveyor/pr checkPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 1/5 Under an hour Newbie friendliness 74/100
activescott/lessmsi#309 · 3 comments ·