hi folks. i ran a simple snyk scan on the latest l...
# luceej
jamiejackson
05/02/2023, 3:06 PMhi folks. i ran a simple snyk scan on the latest lucee docker image. i'm new to snyk scans but there sure seems like a lot of vulnerabilities identified: 19 critical, 28 high.
debian 11 has 0 critical, 2 high.
can anyone tell me why I shouldn't be worried?
https://gist.github.com/jamiejackson/1b6adec3f23e505127ce36074c55c4c7
jamiejackson
05/02/2023, 3:09 PMto reproduce:
Copy code
docker pull lucee/lucee:5.3.9.133
docker scan lucee/lucee:5.3.9.133z
zackster
05/02/2023, 3:12 PM5.3.10.120 is the latest
👀 1
j
jamiejackson
05/02/2023, 3:13 PMhmm, i guess the docker hub docs get out of date: https://hub.docker.com/r/lucee/lucee
jamiejackson
05/02/2023, 3:14 PMi'll try with the actual latest
z
zackster
05/02/2023, 3:14 PMthe conceptual problem is docker images are published only once, when the lucee build is first released
zackster
05/02/2023, 3:15 PMwhich I've addressed somewhat with the installers this way https://dev.lucee.org/t/universal-lucee-installer-choose-which-lucee-version-you-want-to-install/12551
j
jamiejackson
05/02/2023, 3:22 PMlatest has 12 critical, 19 high vulnerabilities
jamiejackson
05/02/2023, 3:46 PMos patches in the that image take them down to 1 critical, 4 high,
b
bdw429s
05/02/2023, 6:47 PM@jamiejackson can you post a gist with the Lucee cves in 5.3.10? I know there are a couple in Hibernate which should finally go away in 5.4 when they bump the ORM extension version.
j
jamiejackson
05/02/2023, 7:09 PM@bdw429s, before and after an apt upgrade: https://gist.github.com/jamiejackson/768dac0261e14cb5f4601c7a64f25b7e
jamiejackson
05/02/2023, 7:22 PMand here's the (apt-get upgrade) image scanned with the (more thorough?) trivy tool. json and table format reports are included: https://gist.github.com/jamiejackson/c45b2ca5a37e828e480a5e3c8d8e9004
jamiejackson
05/02/2023, 7:23 PMthe table's less detailed but easier to digest. it's at the bottom.
jamiejackson
05/02/2023, 7:28 PMtrivy's report (even after an os package upgrade):
Total: 58 (UNKNOWN: 1, LOW: 5, MEDIUM: 9, HIGH: 24, CRITICAL: 19)
b
bdw429s
05/02/2023, 7:29 PMThat's all way more than I can read on my phone, but here's the existing ticket of known vulns
https://luceeserver.atlassian.net/browse/LDEV-4279
bdw429s
05/02/2023, 7:29 PMYou can see if everything is already reported or not.
j
jamiejackson
05/02/2023, 7:36 PMi'm only looking at criticals, but i see a few that aren't on your list in that ticket.
jamiejackson
05/02/2023, 7:37 PMimage.png
jamiejackson
05/08/2023, 7:10 PMi added some questions/comments to the ticket, @bdw429s: https://luceeserver.atlassian.net/browse/LDEV-4279?focusedCommentId=53589
TL;DR:
• there seem to be unreported vulnerabilities in addition to the reported ones
• some of the reported ones, which are claimed to be fixed in the lucee 5.3.10 don't actually seemed to be fixed (in the latest, 5,3.10,120)
b
bdw429s
05/08/2023, 7:11 PMI saw. The green lines are based on the feedback from Zac regarding what was patched. If those vulns are still showing up them perhaps they weren't patched ¯\_(ツ)_/¯
bdw429s
05/08/2023, 7:11 PMZac would need to chime in on that
👍 1