How to address python3.7 Docker vulnerabilities reported in docker scan

Question

We are trying to build our service as docker image. We are having flask service in docker image. If we use python3.7 as base image, we are getting many vulnerabilities. Even after upgrading versions, issues are still reported.

To reproduce the issue, a basic docker image is given here.

FROM python:3.7
CMD ["sleep", "300"]

sudo docker build -t p37:basic-f ./Dockerfile .
sudo docker tag p37:basic $DOCKER_LOGIN_URL/repo:p37_basic
sudo docker push $DOCKER_LOGIN_URL/repo:p37_basic

When this image is pushed to AWS Container registry, scan report is showing many vulnerabilities.

Giving a sample issue reported. CVE-2022-2097

The issue says that we need to update openssl to openssl 1.1.1q. We ran the image locally and found that we have openssl 1.1.1n installed.

sudo docker run p37:basic &

sudo docker container list

CONTAINER ID   IMAGE       COMMAND        CREATED          STATUS      PORTS     NAMES 77a25f41da01   p37:basic   "sleep 6000"   15 seconds ago   Up 14 seconds             eager_black

sudo docker exec -it 77a25f41da01 /bin/bash

root@77a25f41da01:/# openssl version -a OpenSSL 1.1.1n  15 Mar 2022 built on: Fri Jun 24 20:22:19 2022 UTC platform: debian-amd64 options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)  compiler: gcc -fPIC
-pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -ffile-prefix-map=/build/openssl-qQYEec/openssl-1.1.1n=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2 OPENSSLDIR: "/usr/lib/ssl" ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1" Seeding source: os-specific root@77a25f41da01:/#

So we decided to upgrade openssl in docker image.

FROM python:3.7
RUN apt-get update
RUN apt-get install software-properties-common --yes

# OPENSSL
RUN apt-get update && \
    apt-get install --yes --no-install-recommends wget build-essential libcurl4 && \
    wget https://www.openssl.org/source/openssl-1.1.1q.tar.gz && \
    tar -xvf openssl-1.1.1q.tar.gz  && cd openssl-1.1.1q && \
    ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib && make && make install


RUN echo "/usr/local/ssl/lib" >> /etc/ld.so.conf.d/openssl-1.1.1q.conf
RUN cat /etc/ld.so.conf.d/openssl-1.1.1q.conf
RUN ldconfig -v
RUN mv /usr/bin/c_rehash /usr/bin/c_rehash.backup
RUN mv /usr/bin/openssl /usr/bin/openssl.backup
ENV PATH="${PATH}:/usr/local/ssl/bin"

CMD ["sleep", "6000"]

When we run the docker image locally and checked inside the container, latest openssl is installed.

sudo docker exec -it c3314b7efeea /bin/bash

root@c3314b7efeea:/# openssl version -a
OpenSSL 1.1.1q  5 Jul 2022
built on: Fri Aug  5 17:26:11 2022 UTC
platform: linux-x86_64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr) 
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -O3 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DZLIB -DNDEBUG
OPENSSLDIR: "/usr/local/ssl"
ENGINESDIR: "/usr/local/ssl/lib/engines-1.1"
Seeding source: os-specific
root@c3314b7efeea:/#

But when this is pushed to elastic container registry in AWS, openssl issue is still reported in the scan reports. (we checked in Google container registry too. Similar behaviour only)

Why the fix is not reflecting in scan reports? or is there alternative way to fix these vulnerabilities?

user_3211801 · Answer

Posting this as workaround. Among the 2 questions,

Why the fix is not reflecting in scan reports? still unanswered

is there alternative way to fix these vulnerabilities? - This workaround solution.

We are taking ubuntu:20.04 as base docker images and then adding required files for docker.

This drastically reduced the count of scanned vulnerabilities. Now we have 2 low and few information entries in docker scan reports of AWS ECR.

FROM ubuntu:20.04
RUN apt-get update
RUN apt-get install software-properties-common --yes
RUN apt-get install build-essential wget -y
RUN apt-get install python3-pip -y
RUN pip install --upgrade pip
CMD ["sleep", "300"]

This will have in-built python3.8.

We can use like

CMD ["python3", "testfile.py"]

or create alias and use python

How to address python3.7 Docker vulnerabilities reported in docker scan

1 Answers