Vulnerabilities in the official Docker image

Hi! I have recently pulled the official Discourse docker image and analysed it with Trivy (a security and vulnerability scanner). The result shows several vulnerabilities:

$ trivy image --vuln-type library discourse/base:release
...
Node.js (node-pkg)

Total: 19 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 15, CRITICAL: 2)

┌─────────────────────────────────────┬─────────────────────┬──────────┬───────────────────┬────────────────────────────┬──────────────────────────────────────────────────────────────┐
│               Library               │    Vulnerability    │ Severity │ Installed Version │       Fixed Version        │                            Title                             │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ ansi-html (package.json)            │ CVE-2021-23424      │ HIGH     │ 0.0.7             │ 0.0.8                      │ nodejs-ansi-html: ReDoS via crafted string                   │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2021-23424                   │
├─────────────────────────────────────┼─────────────────────┤          ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ ansi-regex (package.json)           │ CVE-2021-3807       │          │ 3.0.0             │ 3.0.1, 4.1.1, 5.0.1, 6.0.1 │ nodejs-ansi-regex: Regular expression denial of service      │
│                                     │                     │          │                   │                            │ (ReDoS) matching ANSI escape codes                           │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2021-3807                    │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          ├───────────────────┤                            │                                                              │
│                                     │                     │          │ 4.1.0             │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ clean-css (package.json)            │ GHSA-wxhq-pm8v-cw75 │ LOW      │ 3.4.28            │ 4.1.11                     │ Regular Expression Denial of Service in clean-css            │
│                                     │                     │          │                   │                            │ https://github.com/advisories/GHSA-wxhq-pm8v-cw75            │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ engine.io (package.json)            │ CVE-2023-31125      │ MEDIUM   │ 6.2.1             │ 6.4.2                      │ Uncaught exception in engine.io                              │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2023-31125                   │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ http-cache-semantics (package.json) │ CVE-2022-25881      │ HIGH     │ 4.1.0             │ 4.1.1                      │ Regular Expression Denial of Service (ReDoS) vulnerability   │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-25881                   │
├─────────────────────────────────────┼─────────────────────┤          ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ json5 (package.json)                │ CVE-2022-46175      │          │ 0.5.1             │ 1.0.2, 2.2.2               │ json5: Prototype Pollution in JSON5 via Parse Method         │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-46175                   │
│                                     │                     │          ├───────────────────┤                            │                                                              │
│                                     │                     │          │ 1.0.1             │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ loader-utils (package.json)         │ CVE-2022-37601      │ CRITICAL │ 2.0.2             │ 1.4.1, 2.0.3               │ loader-utils: prototype pollution in function parseQuery in  │
│                                     │                     │          │                   │                            │ parseQuery.js                                                │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-37601                   │
│                                     ├─────────────────────┼──────────┤                   ├────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                     │ CVE-2022-37599      │ HIGH     │                   │ 3.2.1, 2.0.4, 1.4.2        │ A Regular expression denial of service (ReDoS) flaw was      │
│                                     │                     │          │                   │                            │ found in Funct...                                            │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-37599                   │
│                                     ├─────────────────────┤          │                   │                            ├──────────────────────────────────────────────────────────────┤
│                                     │ CVE-2022-37603      │          │                   │                            │ loader-utils:Regular expression denial of service            │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-37603                   │
├─────────────────────────────────────┼─────────────────────┤          ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ minimatch (package.json)            │ CVE-2016-10540      │          │ 0.2.14            │ 3.0.2                      │ Minimatch is a minimal matching utility that works by        │
│                                     │                     │          │                   │                            │ converting glob ...                                          │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2016-10540                   │
│                                     ├─────────────────────┤          │                   ├────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                     │ CVE-2022-3517       │          │                   │ 3.0.5                      │ ReDoS via the braceExpand function                           │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2022-3517                    │
│                                     ├─────────────────────┤          │                   ├────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                     │ NSWG-ECO-118        │          │                   │ >=3.0.2                    │ Regular Expression Denial of Service                         │
├─────────────────────────────────────┼─────────────────────┤          ├───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ taffydb (package.json)              │ CVE-2019-10790      │          │ 2.6.2             │                            │ TaffyDB can allow access to any data items in the DB         │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2019-10790                   │
│                                     │                     │          ├───────────────────┼────────────────────────────┤                                                              │
│                                     │                     │          │ 2.7.3             │                            │                                                              │
│                                     │                     │          │                   │                            │                                                              │
├─────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ underscore (package.json)           │ CVE-2021-23358      │ CRITICAL │ 1.3.3             │ 1.12.1                     │ nodejs-underscore: Arbitrary code execution via the template │
│                                     │                     │          │                   │                            │ function                                                     │
│                                     │                     │          │                   │                            │ https://avd.aquasec.com/nvd/cve-2021-23358                   │
└─────────────────────────────────────┴─────────────────────┴──────────┴───────────────────┴────────────────────────────┴──────────────────────────────────────────────────────────────┘
2023-05-16T18:33:20.715+0200	INFO	Table result includes only package filenames. Use '--format json' option to get the full path to the package file.
...

This is an excerpt of the vulnerabilities being reported, with the full list including +20:

CVE-2015-9284, CVE-2016-10540, CVE-2019-10790, CVE-2020-26235, CVE-2021-23358, CVE-2021-23424, CVE-2021-32810, CVE-2021-3807, CVE-2022-23639, CVE-2022-24713, CVE-2022-25881, CVE-2022-32149, CVE-2022-3517, CVE-2022-37599, CVE-2022-37601, CVE-2022-37603, CVE-2022-46175, CVE-2023-31125, GHSA-2qv5-7mw5-j3cg, GHSA-f85w-wvc7-crwc, GHSA-mc8h-8q98-g5hr, GHSA-rc23-xxgq-x27g, GHSA-wxhq-pm8v-cw75, NSWG-ECO-118 

What is the status on those? Are you planning to address these vulnerabilities in an upcoming release?

Thank you so much in advance!

3 Likes

Hi @jcarmona, our own tooling has also picked up on these ‘vulnerable’ NPM packages. The vast majority relate to build/development tooling. For the couple which are transitive dependencies of Discourse’s client-side JS app, we’re satisfied that the vulnerabilities are not exploitable.

That said, we are always working to upgrade our dependencies, so we do hope to upgrade them all in the not-too-distant future.

7 Likes