Fix docker scan vulnerabilities

[jmcruz1983]

Checking the Dockerfile seems that base image openjdk:11.0.7-jre-slim-buster is bringing some vulnerabilities flagged by some image scanning tools like snyk or harbor.

To get list of vulnerabilities you can run following command:

 docker scan -f docker/openjdk-11/Dockerfile hyperledger/besu:develop-openjdk-11 --severity high

Producing following output:

Tested 91 dependencies for known issues, found 10 issues.

Base Image                  Vulnerabilities  Severity
openjdk:11-jre-slim-buster  62               2 critical, 8 high, 6 medium, 46 low

In addition some alternative base images are recommended:

Recommendations for base image upgrade:

Alternative image types
Base Image                         Vulnerabilities  Severity
openjdk:17-ea-22-jdk-oracle        0                0 critical, 0 high, 0 medium, 0 low
openjdk:16-ea-33                   0                0 critical, 0 high, 0 medium, 0 low
openjdk:17-ea-10-jdk-oracle        0                0 critical, 0 high, 0 medium, 0 low
openjdk:17-ea-26-jdk-oraclelinux8  0                0 critical, 0 high, 0 medium, 0 low

It is not critical but some private docker registry won't allow to pull such images with high severity vulnerabilities.

[macfarla]

docker scan --login
➜  besu git:(main) docker scan -f docker/openjdk-11/Dockerfile hyperledger/besu:develop-openjdk-latest --severity high

Testing hyperledger/besu:develop-openjdk-latest...

✗ High severity vulnerability found in libgcrypt20
  Description: Information Exposure
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-LIBGCRYPT20-1297892
  Introduced through: apt@2.2.4, openjdk-17/openjdk-17-jre-headless@17.0.1+12-1+deb11u2
  From: apt@2.2.4 > apt/libapt-pkg6.0@2.2.4 > libgcrypt20@1.8.7-6
  From: apt@2.2.4 > gnupg2/gpgv@2.2.27-2 > libgcrypt20@1.8.7-6
  From: openjdk-17/openjdk-17-jre-headless@17.0.1+12-1+deb11u2 > cups/libcups2@2.3.3op2-3+deb11u1 > avahi/libavahi-client3@0.8-5 > dbus/libdbus-1-3@1.12.20-2 > systemd/libsystemd0@247.3-6 > libgcrypt20@1.8.7-6
  Image layer: Introduced by your base image (openjdk:11-jre-slim-buster)

✗ Critical severity vulnerability found in glibc/libc-bin
  Description: Use After Free
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-GLIBC-1296898
  Introduced through: glibc/libc-bin@2.31-13+deb11u2, meta-common-packages@meta
  From: glibc/libc-bin@2.31-13+deb11u2
  From: meta-common-packages@meta > glibc/libc6@2.31-13+deb11u2
  Image layer: Introduced by your base image (openjdk:11-jre-slim-buster)



Organization:      macfarla
Package manager:   deb
Target file:       docker/openjdk-11/Dockerfile
Project name:      docker-image|hyperledger/besu
Docker image:      hyperledger/besu:develop-openjdk-latest
Platform:          linux/amd64
Base image:        openjdk:11-jre-slim-buster
Licenses:          enabled

Tested 127 dependencies for known issues, found 2 issues.

Base Image                  Vulnerabilities  Severity
openjdk:11-jre-slim-buster  64               2 critical, 9 high, 5 medium, 48 low

Recommendations for base image upgrade:

Alternative image types
Base Image                         Vulnerabilities  Severity
openjdk:17-ea-22-oraclelinux8      0                0 critical, 0 high, 0 medium, 0 low
openjdk:16-ea-33                   0                0 critical, 0 high, 0 medium, 0 low
openjdk:17-ea-10                   0                0 critical, 0 high, 0 medium, 0 low
openjdk:17-ea-26-jdk-oraclelinux8  0                0 critical, 0 high, 0 medium, 0 low

[fab-10]

@macfarla since the vulnerabilities depends on the Debian based image used by openjdk-11 images, (even upgrading to Bullseye does not help,) I suggest to replace it with the OpenJDK distribution from Eclipse Temurin (the evolution of the AdoptOpenJDK project), that has no high/critical vulnerabilities, as you can see below

PS C:\Users\TWR> docker scan eclipse-temurin:11-jre --severity high

Testing eclipse-temurin:11-jre...

Organization:      fab-10
Package manager:   deb
Project name:      docker-image|eclipse-temurin
Docker image:      eclipse-temurin:11-jre
Platform:          linux/amd64
Base image:        ubuntu:20.04
Licenses:          enabled

✓ Tested 144 dependencies for known issues, no vulnerable paths found.

Base Image    Vulnerabilities  Severity
ubuntu:20.04  19               0 critical, 0 high, 3 medium, 16 low

Recommendations for base image upgrade:

Major upgrades
Base Image              Vulnerabilities  Severity
ubuntu:impish-20211015  13               0 critical, 0 high, 2 medium, 11 low

[jmcruz1983]

Any update about this?

[macfarla]

PR using the suggested version #3137