High Vulnerabilities in minideb-extras-base about minideb

[beltran-rubo]

Hi @zulrang

The issue is minideb:latest is pointing to the latest version 10 (buster) and the Bitnami containers catalog (and minideb-extras-base) continues using Debian 9 (Stretch). You can see those issues are not fixed for version 9 by Debian but they have been fixed for version 8 or 10 e.g. https://security-tracker.debian.org/tracker/CVE-2018-6551 On the other hand, there will be vulnerabilities that will affect only Debian 10 and not 9. We plan to work on supporting the new Debian version 10 for the Bitnami catalog in the next months.

[zulrang]

Thanks for the response. I feel like I understand the process better now.

Are the images for 8 still available?

[beltran-rubo]

Minideb & minideb-extras for Debian 8 (Jessie) are being built on a daily basis. The bitnami catalog is using Debian 9 (Stretch) right now but you can find old images of those containers in Docker Hub that use Debian 8. Not sure if that answer your question or if that is what you are looking for.

[zulrang]

That answers my question. I found the images you're referring to, and note that they are quite old.
For now I'll just have to write a POAM and wait until the catalog is updated to Buster.

Thanks for answering my questions!

[cliffcotino]

@beltran-rubo can you give us some insights regarding when the newer Debian version 10 will be available/used by the Bitnami catalog?

[beltran-rubo]

We do not have a specific ETA right now but we plan to work on this beginning next year (Jan-Feb). Is there any reason why you need Debian 10 instead of Debian 9? We would like to understand if there is any technical issue or any specific feature you are looking for.

[zulrang]

Speaking for myself, the feature we're looking for is "not having High CVE vulnerabilities" which won't be fixed in Debian 9.

[james-w]

Speaking for myself, the feature we're looking for is "not having High CVE vulnerabilities" which won't be fixed in Debian 9.

Hi,

Are you talking about specific vulnerabilities, or the general security update policy for debian oldstable?

Thanks,

James

[zulrang]

There's a list of them, right there in the OP.

[james-w]

Hi,

minideb-extras-base is now deprecated, so this doesn't directly apply. I believe that the
images that used to be built on it will now have upgraded packages when they are built.

I am therefore closing this.

Thanks,

James