Finding fixes for vulnerabilities identified in the images

[gowthamsundar]

I have a docker file that uses the base image as ubunut:20.04 with total of 31 issues and am installing a package https://github.com/sysown/proxysql/releases/download/v2.0.15/proxysql_2.0.15-ubuntu16_amd64.deb and there are more issues reported. Does it mean the additional issues are from the installed package? Also, there is no fix version mentioned for them in the trivy results. please, help on how to mitigate those findings.

Note: while trying to update each package there is a version conflict error since the base image is Debian based.

[gowthamsundar]

@knqyf263 Requesting your support here. Please.

[knqyf263]

Could you share your result? Also, please make sure that your image uses the same digest of ubuntu:20.04 where you tested and found 31 issues.

Some of the vulnerabilities have been confirmed as vulnerable, but no patches might be available yet as follows. "Needed" means the patch is needed, but not provided yet.
https://ubuntu.com/security/CVE-2021-21148

If you want to mitigate such vulnerabilities, you need to look into references and find workarounds.

[gowthamsundar]

Thanks @knqyf263 for your reply, unfortunately, the result is not available to me. But we tried upgrading the base OS to ubuntu:20.10 and most issues got resolved. Will update the thread if there are new queries.

[gowthamsundar]

Also, there are few issues where there no references to fix them, how to handle them?

• Does Trivy identify additional issues installed in Docker Image apart from base os issues?
• If yes what will be the ideal way to fix the issues from identified packages? (We tried updating individual packages but the base os doesn't support it.)

TIA.

[gowthamsundar]

@knqyf263 Requesting your support.

[knqyf263]

Does Trivy identify additional issues installed in Docker Image apart from base os issues?

Trivy supports OS packages and programming language dependencies. If the patch is provided by the vendor, you can update the package version to fix the issue. If that's not the case, you need to work around it yourself.