Activity

1. wglambert commented on Feb 16, 2021

   

   wglambert

   on Feb 16, 2021

   More actions

   Debian Buster is still unfixed so there's nothing actionable we could do https://security-tracker.debian.org/tracker/CVE-2021-3177
   It's also considered a minor issue

   See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves
   And docker-library/openjdk#449 (comment), docker-library/postgres#286 (comment) docker-library/openjdk#161, docker-library/openjdk#112, docker-library/postgres#286, docker-library/drupal#84, docker-library/official-images#2740, docker-library/ruby#117, docker-library/ruby#94, #152, docker-library/php#242, docker-library/buildpack-deps#46, docker-library/openjdk#185.

   A CVE doesn't imply having an actual vulnerability, and often is even a false positive (given how most distributions handle versioning/security updates in stable releases). If there are actionable items we can resolve, we're happy to do so (and do so actively). We update all Debian based images to include any updates in apt packages at least monthly (we regenerate the base images and then rebuild all dependent images).
2. yosifkit commented on Feb 16, 2021

   

   yosifkit

   on Feb 16, 2021

   Member

   More actions

   As for 3.8.x that is downloaded and compiled in the image:

   python/3.8/buster/slim/Dockerfile

   Lines 54 to 78 in ada46dd

   	&& wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz" \
   	&& wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc" \
   	&& export GNUPGHOME="$(mktemp -d)" \
   	&& gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$GPG_KEY" \
   	&& gpg --batch --verify python.tar.xz.asc python.tar.xz \
   	&& { command -v gpgconf > /dev/null && gpgconf --kill all || :; } \
   	&& rm -rf "$GNUPGHOME" python.tar.xz.asc \
   	&& mkdir -p /usr/src/python \
   	&& tar -xJC /usr/src/python --strip-components=1 -f python.tar.xz \
   	&& rm python.tar.xz \
   	\
   	&& cd /usr/src/python \
   	&& gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)" \
   	&& ./configure \
   	--build="$gnuArch" \
   	--enable-loadable-sqlite-extensions \
   	--enable-optimizations \
   	--enable-option-checking=fatal \
   	--enable-shared \
   	--with-system-expat \
   	--with-system-ffi \
   	--without-ensurepip \
   	&& make -j "$(nproc)" \
   	LDFLAGS="-Wl,--strip-all" \
   	&& make install \

   There hasn't been a python 3.8 release since Dec. 21, 2020, https://www.python.org/downloads/. Once they release a new version, we will publish it.
3. tianon

   closed this as completedon Feb 16, 2021
4. asfaltboy commented on Feb 19, 2021

   

   asfaltboy

   on Feb 19, 2021

   More actions

   @yosifkit just to nudge, seeing that the latest version 3.8.8 is now live here, thank you all for your diligence 🙏
5. tianon commented on Feb 19, 2021

   

   tianon

   on Feb 19, 2021

   Member

   More actions

   docker-library/official-images#9658 😉

   (Official builds are in progress.)

   Reacted by Pavel Savchenko