CVE-2015-7547: rebuild images?

[flecno]

Can you rebuild and force push your 1.1.0 and 1.0 image tags to docker hub to make sure the latest debian:jessie base image is used? Or is there any automatic rebuild process on docker hub?

Currently the kylemanna/openvpn:1.1.0 image is vulnerable

$ docker run --rm kylemanna/openvpn:1.1.0 ldd --version
ldd (Debian GLIBC 2.19-18+deb8u1) 2.19

debian:jessie is fixed:

$ docker run --rm debian:jessie ldd --version
ldd (Debian GLIBC 2.19-18+deb8u3) 2.19

The new alpine based images are not affected.

More Information:

• https://security-tracker.debian.org/tracker/CVE-2015-7547
• glibc: CVE-2015-7547 docker-library/official-images#1448

[ypid]

@flecno Very nice that you pay so close attention 👍
I thought yesterday about the same issue and intent to implement a solution for a different Docker image which I maintain: jchaney/owncloud#45

[kylemanna]

@flecno Thanks for keeping an eye on it.

It's probably worth releasing v2.0.0 based on the alpine builds for people to pin their deployments to.

[flecno]

Yes... there have to be a automated rebuild process for this case. There are new images available on docker hub. Thank you for the fast reaction!!

[kylemanna]

@flecno I agree, there should be some policy which dictates a maintenance period for old tagged releases.

[ypid]

@kylemanna Do you consider implementing automatic rebuilds?

[kylemanna]

Depends on the release policy. I don't want to rebuild images just to rebuild images.

[ypid]

Makes sense. I might look into how to check if the base image has actually changed.

[flecno]

I think this is a more general problem which have to solve in a other place. I hope this security issue wake up some people. I think there are many peoples who run dozen docker images which has to rebuild manually? This can not be the right process. If you now some usefull dicussion around this topic, i will be happy to follow

[ypid]

@flecno I think this is your best option in terms of security to build all images locally (including the base image(s) of course). See https://github.com/ypid/docker-makefile 😉 You have to automate container redeployments anyway, so it is no big deal to build them also in the process.

[ypid]

@kylemanna Seems like your image is still vulnerable. Can you fix that please and maybe automate it so that this does not happen in the future?