René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Vulnerable base Amazon image","articleBody":"According to the CI, our base Amazon image has security issues: https://github.com/rust-serverless/lambda-rust/runs/4399791210?check_suite_focus=true\r\n\r\n```\r\n+--------------------+------------------+----------+-------------------+--------------------+---------------------------------------+\r\n|      LIBRARY       | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |   FIXED VERSION    |                 TITLE                 |\r\n+--------------------+------------------+----------+-------------------+--------------------+---------------------------------------+\r\n| nspr               | CVE-2021-43527   | CRITICAL | 4.25.0-2.amzn2    | 4.32.0-1.amzn2     | nss: Memory corruption in             |\r\n|                    |                  |          |                   |                    | decodeECorDsaSignature with           |\r\n|                    |                  |          |                   |                    | DSA signatures (and RSA-PSS)          |\r\n|                    |                  |          |                   |                    | --\u003eavd.aquasec.com/nvd/cve-2021-43527 |\r\n+--------------------+                  +          +-------------------+--------------------+                                       +\r\n| nss                |                  |          | 3.53.1-7.amzn2    | 3.67.0-4.amzn2.0.1 |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+                  +          +-------------------+--------------------+                                       +\r\n| nss-softokn        |                  |          | 3.53.1-6.amzn2    | 3.67.0-3.amzn2     |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+                  +          +                   +                    +                                       +\r\n| nss-softokn-freebl |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+                  +          +-------------------+--------------------+                                       +\r\n| nss-sysinit        |                  |          | 3.53.1-7.amzn2    | 3.67.0-4.amzn2.0.1 |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+                  +          +                   +                    +                                       +\r\n| nss-tools          |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+                  +          +-------------------+--------------------+                                       +\r\n| nss-util           |                  |          | 3.53.1-1.amzn2    | 3.67.0-1.amzn2     |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n|                    |                  |          |                   |                    |                                       |\r\n+--------------------+------------------+----------+-------------------+--------------------+---------------------------------------+\r\n```\r\n\r\nWe need somehow fix it. Maybe, we need just wait for the fix from AWS side and possibly bump our base image version. Also, we can somehow highlight the issue to the AWS related people.","author":{"url":"https://github.com/zamazan4ik","@type":"Person","name":"zamazan4ik"},"datePublished":"2021-12-02T20:12:17.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/33/lambda-rust/issues/33"}