Alpine 3.14.1 Critical vulnerability

[sjaylk]

Hi,

There is a CRITICAL vulnerability fixed for alpine with 3.14.1. CVE-2021-36159
Will a new alpine release be made?

Thanks

[mthalman]

apk-tools is installed in the base Alpine image and all of our .NET images are based on the latest Alpine images. Specifically for Alpine 3.14, we only provide Alpine 3.14 images in our nightly (Preview) repos:

• https://hub.docker.com/_/microsoft-dotnet-nightly-sdk/
• https://hub.docker.com/_/microsoft-dotnet-nightly-aspnet/
• https://hub.docker.com/_/microsoft-dotnet-nightly-runtime/
• https://hub.docker.com/_/microsoft-dotnet-nightly-runtime-deps/

And all those are up-to-date with Alpine 3.14.1.

Was there a particular scan report that this showed up as a vulnerability or are you just asking a general question?

[sjaylk]

I've been using the released images. That is why I've been getting this vulnerability in the scans. I will use the nightly until they are released.

Thank you.

[mthalman]

The Alpine 3.13 images for .NET have been rebuilt so that they include a newer version of apk-tools that should no longer show up as vulnerable.