Python vulnerabilities in ubuntu images #72
Comments
|
I tried creating a new docker image with root access to play around with it (e.g. install At least from an audit perspective, this seems to get rid of all but 3 of the fixable ones: FROM kasmweb/firefox:1.13.1-rolling
USER root
RUN apt-get update && apt-get autoremove -y
USER 1000I tried updating the I haven't tested this out yet though, so I'm not sure how accurate that is that they're no longer required. There are a few things mentioning xserver, which seems like it might be needed for kasm. |
|
We pin our release tags, so just like you saw you would want to use the rolling or even the As for deps for single app images we rip out some stuff after the installation is complete here: How Ubuntu meta packages work that means the system thinks those packages are not needed anymore but definitely are. In general once a single app image is cut people are not really supposed to be playing around with it, building it from core up will always be your best bet. |
|
OK yeah the image won't boot up after that. Doing a much less invasive update of packages, here the container still seems to work. I tried to just update vulnerable python packages to a non-vulnerable version if it's a non-breaking change: FROM kasmweb/firefox:1.13.1-rolling
USER root
RUN apt-get update && \
apt-get install -y python3-pip && pip install --upgrade pip && apt-get remove -y python3-pip
RUN pip install --upgrade setuptools wheel certifi
RUN apt-get remove -y \
python3-pip python3-wheel python3-setuptools python3-certifi \
python3-oauthlib python3-requests python3-psutil python3-urllib3 python3-protobuf
RUN cp $(python3 -c 'import certifi; print(certifi.where())') /etc/ssl/certs/ca-certificates.crt
RUN pip install --upgrade oauthlib~=3.2 requests~=2.31 psutil~=5.9 urllib3~=1.26 protobuf~=3.20
USER 1000And then testing with this, I'm still able to boot up the container and see firefox without any issues This doesn't fix everything, and cryptography especially has a lot of issues, but gets it down to 12 vulnerabilities |
Where are all those packages installed? I would think for anything using python it would make sense to just install To fix the cryptography issue, whatever's using it would need to deal with the breaking changes, but I haven't figured out where the python code is that's using it. Maybe there's something installed via apt-get that relies on system versions of |
|
They would be deps and would be ingested using apt. You can look over the core image here: |
|
If you are actually trying to pass a security audit using Ubuntu is pointless, you would want to base the image off the Alpine 3.18 Baseimage: https://github.com/kasmtech/workspaces-images/blob/develop/src/alpine/install/firefox/install_firefox.sh |
During a security audit on some images we're using, some packages got flagged as high and critical. I'm looking specifically at
kasmweb/firefox:1.13.1but a lot are coming from the base,core-ubuntu-focal, so this likely applies to quite a few images.Most of these are fixed in the
-rollingversion, (especially CVEs that have a fix) but there are still a few left over that seem to be coming from some python packages. I haven't been able to track down where they're getting installed.(just showing the overview for brevity)
and a little more detail on which package have issues:
The text was updated successfully, but these errors were encountered: