deis/slugrunner

USN-3438-1: Git vulnerability

Bregor opened this issue · 8 comments

Bregor commented

Package git-core should be upgraded in quay.io/deis/slugrunner image due to USN-3438-1

bacongobbler commented

I kicked off CI since heroku/cedar:14 was recently rebuilt. We are no longer vulnerable.

git

stuszynski commented

Hi. I'm not so sure about this fix.

$ docker run --entrypoint=dpkg deis/slugrunner:v2.4.0 --list git
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                               Version                             Architecture Description
+++-==================================-===================================-============-===========================================================================================
ii  git                                1:1.9.1-1ubuntu0.5                  amd64        fast, scalable, distributed revision control system

In deis/slugrunner:v2.4.0 there is a git package in 1:1.9.1-1ubuntu0.5 version installed. In the last relase of heroku/cedar there is 1:1.9.1-1​ubuntu0.6 version, but according to usn-3438-1 we need 1:1.9.1-1ubuntu0.7(changelog) to fix CVE-2017-14867.

It's also related to deis/slugbuilder#144

bacongobbler commented

Thank you @stuszynski. Would you mind filing a ticket upstream at https://github.com/heroku/stack-images to bump git? It does indeed appear that this has not been resolved. Thank you for double-checking.

szymonpk commented

Git was updated in the latest cedar.

stuszynski commented

@bacongobbler Would you kick off CI again? I can see the last build was pushed 5 days ago but it still has git - 1:1.9.1-1ubuntu0.5.

bacongobbler commented

fixed for slugrunner v2.4.0. I'm kicking off the pipeline for slugbuilder and will close this once that's done. Sorry for the delay!

><> docker run --entrypoint=dpkg deis/slugrunner:v2.4.0 --list git
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                               Version                             Architecture Description
+++-==================================-===================================-============-===========================================================================================
ii  git                                1:1.9.1-1ubuntu0.7                  amd64        fast, scalable, distributed revision control system
  • 🎉2
bacongobbler commented

actually I'll close this and close deis/slugbuilder#144 once slugbuilder's been fixed.