This document tracks security vulnerabilities in the WSI Slides Processor Docker image and the actions taken to address them.

Details:

• Issue: Request smuggling vulnerability in net/http package
• Fix Available: Go 1.23.8
• Current Base Image: Uses Go 1.23.1 (embedded in Azure Functions runtime)
• Mitigation: Upgraded to Python 3.13 base image (latest available)
• Monitoring: Check mcr.microsoft.com/azure-functions/python weekly

• Current: mcr.microsoft.com/azure-functions/python:4-python3.12
• Status: Latest stable version available (Python 3.13+ only available in -appservice variant)
• Reason: Most recent security patches for standard Azure Functions runtime

Added explicit installation of vulnerable packages to ensure latest versions:

apt-get install -y --no-install-recommends \
    libxml2 \
    libc6 \
    libc-bin \
    perl-base \
    xserver-common

• Combined RUN commands to reduce layers
• Added --no-cache-dir to pip for smaller image size
• Removed build dependencies after use
• Added comprehensive .dockerignore

1. Check for base image updates:

   docker pull mcr.microsoft.com/azure-functions/python:4-python3.13
   docker image inspect mcr.microsoft.com/azure-functions/python:4-python3.13

2. Rebuild the image:

   docker build -t wsi-slides-processor:latest .

3. Scan for vulnerabilities:

   # Using Docker Scout
   docker scout cves wsi-slides-processor:latest
   
   # Or using Trivy
   trivy image wsi-slides-processor:latest

1. Review CVE databases for new vulnerabilities
2. Update this document with new findings
3. Test application compatibility with latest base images

• Docker Scout: Built into Docker Desktop
• Trivy: Open-source vulnerability scanner
• Snyk: Commercial solution with free tier
• Azure Defender for Containers: If deploying to Azure

Docker Scout:

docker scout cves wsi-slides-processor:latest --only-severity critical,high

Trivy:

trivy image --severity CRITICAL,HIGH wsi-slides-processor:latest

If a new critical vulnerability is discovered:

1. Assess Impact: Determine if the vulnerability affects your deployment
2. Check for Fixes: Look for updated packages or base images
3. Test Updates: Build and test with updated dependencies
4. Deploy: Roll out the patched image
5. Document: Update this file with the CVE and resolution

• Azure Functions Base Images
• Debian Security Tracker
• CVE Database
• National Vulnerability Database

For security concerns, contact: [Your Security Team Email]

Note: This is a living document. Update it whenever security changes are made to the Docker image.