-
Notifications
You must be signed in to change notification settings - Fork 1.8k
Description
Is your feature request related to a problem? Please describe.
The current official docker image provided by the project is based on Debian Bookworm (12)
Because of that some security scanner reports those two important CVE :
Here with Trivy :
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
│ libldap-2.5-0 │ CVE-2023-2953 │ HIGH │ 2.5.13+dfsg-5 │ │ openldap: null pointer dereference in ber_memalloc_x https://avd.aquasec.com/nvd/cve-2023-2953 │
│ zlib1g │ CVE-2023-45853 │ CRITICAL │ 1:1.2.13.dfsg-1 │ │ zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 https://avd.aquasec.com/nvd/cve-2023-45853 │
Debian team seems to considered them harmless and did not planned any fix, but still there presence calls for concerns and discussions with corporate security teams.
Describe the solution you'd like
Now that Fluentbit 4.1 is compatible with Debian Trixie (13), it would be valuable if the project could propose official images based on Debian Trixie (13) which don't have those particular CVEs.
Describe alternatives you've considered
Building and maintaining a custom image would probably be possible, but such official image would benefit quickly to the whole community