alpine-docker/git

Vulnerability in libexpat < 2.4.9 CVE-2022-40674

gvdmarck opened this issue · 2 comments

gvdmarck commented

Latest image contains libexpat 2.4.8 which has a critical vulnerability CVE-2022-40674 (pulled as a git dependency).

Would it be possible to re build an image with libexpaxt 2.4.9 ?

ozbillwang commented

thanks to report the issue, I have re-built the image, seems it got latest libexpat. Please confirm.

I also added feature to run trivy scan on the image and generate the report

image

if compare with the old image

image

  • 👍1
gvdmarck commented

Hello Bill,

We just did a rebuild and everything is fine, snyk is happy.

Thank you for the swift reaction!

  • 😄1