question on how are system libraries updated?
pahnin opened this issue · 2 comments
for couple of weeks, the ruby image is showing as vulnerable because of rexml gem coming from ruby images seems to have stuck to 3.2.8
the rexml version which seems safe to use seems to be 3.3.6
but the system ruby available in all ruby images seems to have stuck to 3.2.8
I don't see how this can be updated unless someone triggers a rebuild of docker images?
I don't know what is the process involved or if I should submit a PR?
The image will be rebuilt when a new release of Ruby is available or when the Debian image gets an update (whichever comes first)
I think this is a case of a Gem that's part of Ruby upstream's distribution of Ruby itself, not something we've explicitly installed.
It does look like CVE fixes for REXML were included in https://github.com/ruby/ruby/releases/tag/v3_3_5 though, so this might be fixed by 04175a1? (docker-library/official-images#17475)