From d30d1752e83d1a8edeb8c1b92395ba9af61685a7 Mon Sep 17 00:00:00 2001 From: Julian Ladisch Date: Wed, 22 Nov 2023 22:04:45 +0100 Subject: [PATCH] apk upgrade, apt-get upgrade fixing openssl/libcrypto3 vulns Add apk upgrade and apt upgrade to Dockerfile. This upgrades openssl/libcrypto3 from 3.1.3-r0 to 3.1.4-r1 fixing Weak Encryption and Denial of Service: * https://nvd.nist.gov/vuln/detail/CVE-2023-5363 * https://nvd.nist.gov/vuln/detail/CVE-2023-5678 --- simple-perl/Dockerfile | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/simple-perl/Dockerfile b/simple-perl/Dockerfile index 9c79f34..7ff0c2e 100644 --- a/simple-perl/Dockerfile +++ b/simple-perl/Dockerfile @@ -8,11 +8,16 @@ FROM alpine -RUN apk add --no-cache perl perl-net-server perl-json perl-cgi perl-lwp-useragent-determined +# Install latest patch versions of packages: https://pythonspeed.com/articles/security-updates-in-docker/ +RUN apk upgrade \ + && apk add \ + perl perl-net-server perl-json perl-cgi perl-lwp-useragent-determined \ + && rm -rf /var/cache/apk/* # or: #FROM perl:slim -#RUN apt-get update && apt-get -y install libnet-server-perl libjson-perl libcgi-pm-perl libmodule-build-perl libwww-perl +## Install latest patch versions of packages: https://pythonspeed.com/articles/security-updates-in-docker/ +#RUN apt-get update && apt-get -y upgrade && apt-get -y install libnet-server-perl libjson-perl libcgi-pm-perl libmodule-build-perl libwww-perl #ENV PERL5LIB /usr/share/perl5 # Set the location of the script