Skip to content

Conversation

@jupyterhub-bot
Copy link
Collaborator

A rebuild of quay.io/jupyterhub/k8s-hub has been found to influence the detected vulnerabilities! This PR will trigger a rebuild because it has updated a comment in the Dockerfile.

About

This scan for known vulnerabilities has been made by aquasecurity/trivy. Trivy was configured to filter the vulnerabilities with the following settings:

  • ignore-unfixed: true

Before

Before trying to rebuild the image, the following vulnerabilities was detected in quay.io/jupyterhub/k8s-hub:4.0.0-0.dev.git.6734.h09260346.

Target Vuln. ID Package Name Installed v. Fixed v.
debian CVE-2024-45490 libexpat1 2.5.0-1 2.5.0-1+deb12u1
debian CVE-2024-45491 libexpat1 2.5.0-1 2.5.0-1+deb12u1
debian CVE-2024-45492 libexpat1 2.5.0-1 2.5.0-1+deb12u1
node-pkg CVE-2024-38999 requirejs 2.3.6 2.3.7
python-pkg CVE-2024-6345 setuptools 65.5.1 70.0.0
python-pkg GHSA-h4gh-qq45-vh27 cryptography 43.0.0 43.0.1

After

Target Vuln. ID Package Name Installed v. Fixed v.
node-pkg CVE-2024-38999 requirejs 2.3.6 2.3.7
python-pkg CVE-2024-6345 setuptools 65.5.1 70.0.0
python-pkg GHSA-h4gh-qq45-vh27 cryptography 43.0.0 43.0.1

@jupyterhub-bot jupyterhub-bot added the image:rebuild-to-patch-vuln Image rebuild to patch a known external vulnerability label Sep 23, 2024
@consideRatio
Copy link
Member

I'll rebuild images soon

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

image:rebuild-to-patch-vuln Image rebuild to patch a known external vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants