Vulnerabilities [CVE-2021-23839, CVE-2021-23840, CVE-2021-23841] found against various alpine versions of python

[ankitsrao]

Hi Team,

Vulnerabilities [CVE-2021-23839, CVE-2021-23840, CVE-2021-23841] found against various alpine versions of python3.7.
I can't find a production image that scans clean nor can I find a way to remediate the vulnerability, as it seems that these are newly reported vulnerabilities.

Also, found that there is the below note on the NVD page for each of the above mentioned vulnerabilities:
"This vulnerability is currently awaiting analysis."

Request to provide some help around the resolution of the same.

Thanks,

[wglambert]

Alpine's openssl was recently updated to 1.1.1j which addressed those CVE's
https://git.alpinelinux.org/aports/commit/?h=3.13-stable&id=9235437f759653dcdb458e1e61d43a933fdd3a05

However for this image openssl is removed during build time and doesn't make it to the final layer, basically:

	&& apk add --no-cache --virtual .build-deps  \
		. . .
		openssl-dev \
		. . .
	&& apk del --no-network .build-deps \

python/3.7/alpine3.13/Dockerfile

Lines 44 to 60 in 9ec46df

	&& apk add --no-cache --virtual .build-deps \
	bluez-dev \
	bzip2-dev \
	coreutils \
	dpkg-dev dpkg \
	expat-dev \
	findutils \
	gcc \
	gdbm-dev \
	libc-dev \
	libffi-dev \
	libnsl-dev \
	libtirpc-dev \
	linux-headers \
	make \
	ncurses-dev \
	openssl-dev \

See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves
And docker-library/openjdk#449 (comment), docker-library/postgres#286 (comment) docker-library/openjdk#161, docker-library/openjdk#112, docker-library/postgres#286, docker-library/drupal#84, docker-library/official-images#2740, docker-library/ruby#117, docker-library/ruby#94, #152, docker-library/php#242, docker-library/buildpack-deps#46, docker-library/openjdk#185.

A CVE doesn't imply having an actual vulnerability, and often is even a false positive (given how most distributions handle versioning/security updates in stable releases). If there are actionable items we can resolve, we're happy to do so (and do so actively). We update all Debian based images to include any updates in apt packages at least monthly (we regenerate the base images and then rebuild all dependent images).

[tianon]

See also docker-library/official-images#9641 which will fix this particular set in Alpine 3.13.

[ankitsrao]

Thank you @wglambert and @tianon for your inputs. The vulnerabilities seem to be resolved for python alpine images.