Fix CVE with libexpat on alpine

[benconda]

Describe the bug

Hello, using trivy analyser on nginx alpine image report critical, fixed CVE on libexpat.

To reproduce

Steps to reproduce the behavior:

1. Install Trivy
2. Run trivy image --ignore-unfixed --severity CRITICAL --no-progress nginx:alpine

Expected behavior

This is fixed in alpine images, can you update nginx (and unpriviledge one) images with updated libexpat lib?

Additional information

┌──────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library  │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libexpat │ CVE-2024-45490 │ CRITICAL │ fixed  │ 2.6.2-r0          │ 2.6.3-r0      │ libexpat: Negative Length Parsing Vulnerability in libexpat │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45490                  │
│          ├────────────────┤          │        │                   │               ├─────────────────────────────────────────────────────────────┤
│          │ CVE-2024-45491 │          │        │                   │               │ libexpat: Integer Overflow or Wraparound                    │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45491                  │
│          ├────────────────┤          │        │                   │               ├─────────────────────────────────────────────────────────────┤
│          │ CVE-2024-45492 │          │        │                   │               │ libexpat: integer overflow                                  │
│          │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45492                  │
└──────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

Thank you.

[dawogid]

We have the same problem at the moment.

[oxpa]

@benconda libexpat is a part of the base operating system. And https://hub.docker.com/_/nginx is part of https://github.com/docker-library/official-images/ which are built by Docker Inc.
You can raise an issue with official-images for images to be rebuilt.

[benconda]

Hi, is it the same for the https://hub.docker.com/r/nginxinc/nginx-unprivileged image ? This one is impacted too.

[oxpa]

nginx-unprivileged is not a part of official images (I know, it's confusing a bit...) and for it an issue should be raised at https://github.com/nginxinc/docker-nginx-unprivileged

[legal90]

@benconda It seems that this issue was fixes in alpine 3.20.3. These tags of nginxinc/nginx-unprivileged contain the fix:

• https://hub.docker.com/layers/nginxinc/nginx-unprivileged/1.27.1-alpine/images/sha256-c609fcc09c937e464ac5cc69d625553c8c76e16f843ae1dc780367d99f7a8e8e?context=explore
• https://hub.docker.com/layers/nginxinc/nginx-unprivileged/1.27-alpine/images/sha256-c609fcc09c937e464ac5cc69d625553c8c76e16f843ae1dc780367d99f7a8e8e?context=explore
• https://hub.docker.com/layers/nginxinc/nginx-unprivileged/1.27-alpine3.20/images/sha256-c609fcc09c937e464ac5cc69d625553c8c76e16f843ae1dc780367d99f7a8e8e?context=explore

[benconda]

Thanks, it's indeed fixed on latest build. Let's close this issue.