From 725cdd04654cd870598caa02b2193c882db1b5cc Mon Sep 17 00:00:00 2001 From: Nitin Shelke <58942444+nshelke777@users.noreply.github.com> Date: Sun, 6 Aug 2023 19:52:31 +0530 Subject: [PATCH] Update Dockerfile for libssl3 and libcrypto3 CVE's (#3783) * Update Dockerfile for libssl3 and libcrypto3 CVE's Out Aquasec tool reported below High Vulnarability in libssl3:3.1.0-r4 and libcrypto3:3.1.0-r4. CVE's - CVE-2023-2650 This is fixed in 3.1.1-r0 so anything greater than this version is fine, thats why updating this to latest. * Fix broken merge conflict Signed-off-by: Raffaele Di Fazio --------- Signed-off-by: Raffaele Di Fazio Co-authored-by: Raffaele Di Fazio --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index c2c2ea314..f4eca3900 100644 --- a/Dockerfile +++ b/Dockerfile @@ -27,7 +27,7 @@ COPY . . FROM alpine:3.18 -RUN apk update && apk add "libcrypto3>=3.0.8-r4" "libssl3>=3.0.8-r4" && rm -rf /var/cache/apk/* +RUN apk update && apk add "libcrypto3>=3.1.1-r0" "libssl3>=3.1.1-r0" && rm -rf /var/cache/apk/* COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=builder /sigs.k8s.io/external-dns/build/external-dns /bin/external-dns