Skip to content

Provide official fluentbit docker image based on new Debian Trixie (13) #11063

@farrault

Description

@farrault

Is your feature request related to a problem? Please describe.
The current official docker image provided by the project is based on Debian Bookworm (12)
Because of that some security scanner reports those two important CVE :

Here with Trivy :
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
│ libldap-2.5-0 │ CVE-2023-2953 │ HIGH │ 2.5.13+dfsg-5 │ │ openldap: null pointer dereference in ber_memalloc_x https://avd.aquasec.com/nvd/cve-2023-2953
│ zlib1g │ CVE-2023-45853 │ CRITICAL │ 1:1.2.13.dfsg-1 │ │ zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 https://avd.aquasec.com/nvd/cve-2023-45853

Debian team seems to considered them harmless and did not planned any fix, but still there presence calls for concerns and discussions with corporate security teams.

Describe the solution you'd like

Now that Fluentbit 4.1 is compatible with Debian Trixie (13), it would be valuable if the project could propose official images based on Debian Trixie (13) which don't have those particular CVEs.

Describe alternatives you've considered
Building and maintaining a custom image would probably be possible, but such official image would benefit quickly to the whole community

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions