From f0b8d68f70185a70f689afd77960720c0b5eda87 Mon Sep 17 00:00:00 2001 From: Hui Wang Date: Tue, 9 Jul 2024 11:38:05 +0200 Subject: [PATCH] security: upgrade base docker image (Alpine) from 3.20.0 to 3.20.1 See https://www.alpinelinux.org/posts/Alpine-3.20.1-released.html >including security fixes for: OPENSSL [CVE-2024-4741](https://security.alpinelinux.org/vuln/CVE-2024-4741) BUSYBOX [CVE-2023-42364](https://security.alpinelinux.org/vuln/CVE-2023-42364) [CVE-2023-42365](https://security.alpinelinux.org/vuln/CVE-2023-42365) (cherry picked from commit 8e9f98e72528ebbbdb2a681ad45aea4bcc1d3f2a) --- app/vmui/Dockerfile-web | 2 +- deployment/docker/Makefile | 4 ++-- docs/CHANGELOG.md | 1 + 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/app/vmui/Dockerfile-web b/app/vmui/Dockerfile-web index 022b9bd103..e6ba48b502 100644 --- a/app/vmui/Dockerfile-web +++ b/app/vmui/Dockerfile-web @@ -6,7 +6,7 @@ COPY web/ /build/ RUN GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o web-amd64 github.com/VictoriMetrics/vmui/ && \ GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o web-windows github.com/VictoriMetrics/vmui/ -FROM alpine:3.20.0 +FROM alpine:3.20.1 USER root COPY --from=build-web-stage /build/web-amd64 /app/web diff --git a/deployment/docker/Makefile b/deployment/docker/Makefile index 5ad702ed6e..b13c5aedf8 100644 --- a/deployment/docker/Makefile +++ b/deployment/docker/Makefile @@ -2,8 +2,8 @@ DOCKER_NAMESPACE ?= victoriametrics -ROOT_IMAGE ?= alpine:3.20.0 -CERTS_IMAGE := alpine:3.20.0 +ROOT_IMAGE ?= alpine:3.20.1 +CERTS_IMAGE := alpine:3.20.1 GO_BUILDER_IMAGE := golang:1.22.5-alpine BUILDER_IMAGE := local/builder:2.0.0-$(shell echo $(GO_BUILDER_IMAGE) | tr :/ __)-1 diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 97334e71ba..246b1aeb2c 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -12,6 +12,7 @@ The following `tip` changes can be tested by building VictoriaMetrics components ## v1.93.x long-time support release (LTS) * SECURITY: upgrade Go builder from Go1.22.4 to Go1.22.5. See the list of issues addressed in [Go1.22.5](https://github.com/golang/go/issues?q=milestone%3AGo1.22.5+label%3ACherryPickApproved). +* SECURITY: upgrade base docker image (Alpine) from 3.20.0 to 3.20.1. See [alpine 3.20.1 release notes](https://www.alpinelinux.org/posts/Alpine-3.20.1-released.html). * BUGFIX: [vmalert](https://docs.victoriametrics.com/vmalert/): fix path for system links printed on default vmalert's UI page when `-http.pathPrefix` is set. * BUGFIX: [vmbackup](https://docs.victoriametrics.com/vmbackup/): properly configure authentication with S3 when `-configFilePath` cmd-line flag is specified.