Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): Bump python from 3.11.3-alpine3.16 to 3.11.4-alpine3.18 #293

Merged
merged 1 commit into from
Jul 6, 2023

Conversation

arukiidou
Copy link
Contributor

Bump python from 3.11.3-alpine3.16 to 3.11.4-alpine3.18

@arukiidou arukiidou changed the title Bump python from 3.11.3-alpine3.16 to 3.11.4-alpine3.18 build(deps): Bump python from 3.11.3-alpine3.16 to 3.11.4-alpine3.18 Jun 28, 2023
@dbluxo
Copy link

dbluxo commented Jul 6, 2023

This would also fix CVE-2023-2650 & CVE-2023-29491:

python:3.11.3-alpine3.16 (alpine 3.16.5)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 0)

┌───────────────────────┬────────────────┬──────────┬───────────────────┬──────────────────┬─────────────────────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │ Installed Version │  Fixed Version   │                            Title                            │
├───────────────────────┼────────────────┼──────────┼───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ libcrypto1.1          │ CVE-2023-2650  │ HIGH     │ 1.1.1t-r2         │ 1.1.1u-r0        │ Possible DoS translating ASN.1 object identifiers           │
│                       │                │          │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-2650                   │
├───────────────────────┤                │          │                   │                  │                                                             │
│ libssl1.1             │                │          │                   │                  │                                                             │
│                       │                │          │                   │                  │                                                             │
├───────────────────────┼────────────────┤          ├───────────────────┼──────────────────┼─────────────────────────────────────────────────────────────┤
│ ncurses-libs          │ CVE-2023-29491 │          │ 6.3_p20220521-r0  │ 6.3_p20220521-r1 │ Local users can trigger security-relevant memory corruption │
│                       │                │          │                   │                  │ via malformed data                                          │
│                       │                │          │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-29491                  │
├───────────────────────┤                │          │                   │                  │                                                             │
│ ncurses-terminfo-base │                │          │                   │                  │                                                             │
│                       │                │          │                   │                  │                                                             │
│                       │                │          │                   │                  │                                                             │
└───────────────────────┴────────────────┴──────────┴───────────────────┴──────────────────┴─────────────────────────────────────────────────────────────┘
python:3.11.4-alpine3.18 (alpine 3.18.2)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

@dbluxo
Copy link

dbluxo commented Jul 6, 2023

cc #273

@dbluxo
Copy link

dbluxo commented Jul 6, 2023

@jekkel Could you have a look?

@jekkel jekkel added dependencies updated dependencies docker Pull requests that update Docker code labels Jul 6, 2023
@jekkel jekkel merged commit 8428a77 into kiwigrid:master Jul 6, 2023
@arukiidou arukiidou deleted the update/alpine-image branch July 6, 2023 11:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies updated dependencies docker Pull requests that update Docker code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants