manually build gosu with current golang image to resolve CVE (pull/1323)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- docker, go
- Domain
- build-system, security
Research direction
Start by reviewing pull/1323 and the Postgres image build entry points that produce usr/local/bin/gosu. Run trivy image --scanners vuln against the resulting image and compare its findings with the reported CVEs. Done means the image uses a gosu binary built with a supported Go version and the reported vulnerabilities are resolved.
Written by the indexing model from the issue text.
Description
https://github.com/docker-library/postgres/pull/1323
trivy image --scanners vuln
shows that we'll get rid of the following CVE's
usr/local/bin/gosu (gobinary)
Total: 58 (UNKNOWN: 0, LOW: 1, MEDIUM: 23, HIGH: 31, CRITICAL: 3)
gosu security policy https://github.com/tianon/gosu/blob/master/SECURITY.md says they don't update golang for CVE's
So gosu is build with a unsupported version of go (1.20)
The two support go versions that have the most CVE's resolved are 1.23.6 and 1.24.0
I felt using 1.23.6 was a safer upgrade.
Your own documents talk about gosu, and I believe gosu hase a fundamental misunderstanding about what a vulnerability free govulncheck means. I understand it to mean that you don't have any external dependencies with vulnerabilities, not that you shouldn't update compiler versions. They are 2 different things.
This PR removes the CVE caused by gosu by doing a custom build of gosu with a currently supported go version.
And copies it into the final image.
Thanks for your consideration
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/postgres
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1420 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
docker-library/postgres#1419 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
docker-library/postgres#1389 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
docker-library/postgres#1356 · 5 comments · 7 reactions ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
docker-library/postgres#1355 · 10 comments · 11 reactions ·
All issues in docker-library/postgres
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
obra/superpowers#2445 ·
Maintainers usually reply within 5 days
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
oSoWoSo/vOid_Community_repOsitory#240 · 1 comment ·
Maintainers usually reply within 1 day
-
ai-inspected
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
[Bug]: atuin doctor reports "Hub (authenticated)" while the client syncs with a self-hosted serverOpen
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day