Next week, the SpeakNetwork Community plans to continue testing the local Storage-Node software during our TestNet-Sprint. In preparation for this event, I have conducted a thorough analysis of the Docker container using Docker-Scout, and I am sharing the results in this article. This analysis aims to provide guidance and assistance to the developers, urging them to review the package carefully and address some of the identified security vulnerabilities before we proceed with further testing.
I understand that addressing these issues may require significant effort, but I believe it is essential for ensuring the security and reliability of the software. The SpeakNetwork Community is ready and willing to assist by testing newer packages and providing direct feedback across various systems. Our collective goal is to improve the software's robustness and security, creating a more reliable platform for all users.
This article outlines the vulnerabilities found, categorized by severity, and offers recommendations for updating or changing the base image to mitigate these risks. I encourage the developers to prioritize these security fixes, as it will significantly enhance the testing process and overall software quality. We are committed to supporting the developers in this endeavor, ensuring that our testing environment is as secure and stable as possible.
The following presents the analysis results of a Docker container using Docker-Scout to help the software author address potential vulnerabilities.
| Analyzed Image | |
|---|---|
| Target | local://trole-api:latest |
| Digest | 17558460b011 |
| Platform | linux/amd64 |
| Vulnerabilities | 2C 9H 8M 108L 7? |
| Size | 530 MB |
| Packages | 1087 |
git 1:2.39.2-1.1crypto-js 3.3.0node-forge 0.7.6node-forge 0.10.0ip 1.1.9libwmf 0.2.12-5.1nghttp2 1.52.0-1+deb12u1axios 0.27.2openjpeg2 2.5.0-2tiff 4.5.0-6+deb12u1openssh 1:9.2p1-2+deb12u2imagemagick 8:6.9.11.60+dfsg-1.6+deb12u1glibc 2.36-9+deb12u7binutils 2.40-2patch 2.7.6-7openldap 2.5.13+dfsg-5systemd 252.22-1~deb12u1m4 1.4.19-3shadow 1:4.13+dfsg1-1perl 5.36.0-7+deb12u1expat 2.5.0-1util-linux 2.38.1-5+deb12u1gnutls28 3.7.9-2+deb12u2gnupg2 2.2.40-1.1libxml2 2.9.14+dfsg-1.3~deb12u1apt 2.6.1libxslt 1.1.35-1libgcrypt20 1.10.1-3sqlite3 3.40.1-2libpng1.6 1.6.39-2curl 7.88.1-10+deb12u5coreutils 9.1-1gcc-12 12.2.0-14libheif 1.15.1-1tar 1.34+dfsg-1.2+deb12u1krb5 1.20.1-2+deb12u1glib2.0 2.74.6-2+deb12u2jbigkit 2.1-6.1unzip 6.0-28openexr 3.1.5-5openssl 3.0.11-1~deb12u2elfutils 0.188-2.1pixman 0.42.2-1jansson 2.14-2libyaml 0.2.5-1aom 3.6.0-1The analysis reveals multiple critical and high vulnerabilities in the Docker container. It is recommended to update the affected packages or find alternative solutions to ensure the container's security.
For detailed information, refer to the provided CVE and GMS links.
Base image: node:18
| Name | Digest | Vulnerabilities | Pushed | Size | Packages | Runtime |
|---|---|---|---|---|---|---|
| 18 | sha256:7176e37dd29986e14c923bb38f2331f767e167c944915448091039d66dfd1029 | 1C, 2H, 3M, 103L, 3? | 1 month ago | 396 MB | 747 | 18 |
The base image is also available under the supported tag(s): 18-bookworm, 18.20, 18.20-bookworm, 18.20.3, 18.20.3-bookworm, hydrogen, hydrogen-bookworm. To display recommendations for a different tag, re-run the command using the --tag flag.
Rebuild the image using a newer base image version. Updating this may result in breaking changes.
Current Status: This image version is up to date.
The list displays new recommended tags in descending order, where the top results are rated as most suitable.
| Tag | Benefits | Pushed | Vulnerabilities |
|---|---|---|---|
| 22-slim | - Image is smaller by 305 MB - Image contains 425 fewer packages - Major runtime version update - Tag was pushed more recently - Image introduces no new vulnerability but removes 86 - Tag is using slim variant | 2 weeks ago | 0C, 0H, 0M, 23L |
| 20-slim | - Image is smaller by 309 MB - Image contains 423 fewer packages - Major runtime version update - Tag was pushed more recently - Image introduces no new vulnerability but removes 86 - Tag is using slim variant | 1 day ago | 0C, 0H, 0M, 23L |
| 22 | - Image contains 2 fewer packages - Major runtime version update - Tag was pushed more recently - Image has similar size - Tag is latest - Image has same number of vulnerabilities | 2 weeks ago | 1C, 2H, 3M, 103L, 3? |
| 18-slim | - Image is smaller by 312 MB - Image contains 423 fewer packages - Image introduces no new vulnerability but removes 86 - Tag is using slim variant - 18-slim was pulled 33K times last month | 1 month ago | 0C, 0H, 0M, 23L |
| 20 | - Major runtime version update - Tag was pushed more recently - Image has similar size - Image has same number of vulnerabilities - Image contains equal number of packages | 1 day ago | 1C, 2H, 3M, 103L, 3? |
Image details:
I hope this help, if u need further details, hit me up or install docker-desktop with the docker-scout integration to analyse docker-containers.
Thanks and Greetings.