Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update nginx base image to fix CVEs #8697

Merged
merged 1 commit into from
May 24, 2023

Conversation

bkonicek
Copy link
Contributor

Description

Update nginx to fix CVEs

Motivation and Context

There are 2 open CVEs for the nginx:1.23.4-alpine base Docker image. They are both fixed in v1.24.0

How Has This Been Tested?

  1. Opened a PR in my forked repo and observed that the Github Actions checks passed
  2. Built the container locally and confirmed it started successfully

My PR contains...

  • No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
  • Dependency changes (any modification to dependencies in package.json)
  • Bug fixes (non-breaking change which fixes an issue)
  • Improvements (misc. changes to existing features)
  • Features (non-breaking change which adds functionality)

My changes...

  • are breaking changes to a public API (config options, System API, major UI change, etc).
  • are breaking changes to a private API (Redux, component props, utility functions, etc.).
  • are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
  • are not breaking changes.

Documentation

  • My changes do not require a change to the project documentation.
  • My changes require a change to the project documentation.
  • If yes to above: I have updated the documentation accordingly.

Automated tests

  • My changes can not or do not need to be tested.
  • My changes can and should be tested by unit and/or integration tests.
  • If yes to above: I have added tests to cover my changes.
  • If yes to above: I have taken care to cover edge cases in my tests.
  • All new and existing tests passed.

Update nginx to fix CVEs

- CVE-2023-29469
- CVE-2023-28484
Copy link
Member

@char0n char0n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you!

@char0n
Copy link
Member

char0n commented May 24, 2023

NOTE: this would be technically handled by dependabot automatic update during today or tommorow.

- package-ecosystem: "docker"

@char0n char0n merged commit da48ea1 into swagger-api:master May 24, 2023
@char0n char0n self-assigned this May 24, 2023
@char0n char0n added cat: security version: 4.x docker Pull requests that update Docker code labels May 24, 2023
@char0n
Copy link
Member

char0n commented May 25, 2023

@bkonicek looks like the v1.24.0 comes with it's own new vulnerability.

image

More info in https://github.com/swagger-api/swagger-ui/actions/runs/5076116027/jobs/9117981718

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cat: security docker Pull requests that update Docker code version: 4.x
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants