Skip to content

[vulnerabilities] minimal and standard images for 17.5 #189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
c35sys opened this issue May 13, 2025 · 5 comments
Closed

[vulnerabilities] minimal and standard images for 17.5 #189

c35sys opened this issue May 13, 2025 · 5 comments
Assignees
@sxd
Labels
question Further information is requested

Comments

@c35sys
Copy link

c35sys commented May 13, 2025

Hello,

I'm looking for the latest image to have less vulnerabilities in it.

If I use postgresql:17.4-standard-bookworm or postgresql:17.4-standard-bookworm I have the following vulnerabilities:

❯ grype --by-cve ghcr.io/cloudnative-pg/postgresql:17.4-standard-bookworm | grep -E "High|Critical"
 ✔ Loaded image                                                                                                                                                                    ghcr.io/cloudnative-pg/postgresql:17.4-standard-bookworm 
 ✔ Parsed image                                                                                                                                                     sha256:f99d01ce97e8ab542971b4a0dffe5da9907332d644f94c45b4477608b7fb8217 
 ✔ Cataloged contents                                                                                                                                                      0a90aedaea6d3264fc062b4d5eb4da4a4359678935cea077b2b2398f6336eda8 
   ├── ✔ Packages                        [148 packages]  
   ├── ✔ Executables                     [934 executables]  
   ├── ✔ File metadata                   [10,245 locations]  
   └── ✔ File digests                    [10,245 files]  
 ✔ Scanned for vulnerabilities     [165 vulnerability matches]  
   ├── by severity: 0 critical, 12 high, 28 medium, 17 low, 104 negligible (4 unknown)
   └── by status:   0 fixed, 165 not-fixed, 0 ignored (1 dropped)
libldap-2.5-0       2.5.13+dfsg-5            (won't fix)  deb   CVE-2023-2953     High        
libperl5.36         5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2022-49043    High        
libxml2             2.9.14+dfsg-1.3~deb12u1  (won't fix)  deb   CVE-2024-25062    High        
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2024-56171    High        
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-24928    High        
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-27113    High        
libxml2             2.9.14+dfsg-1.3~deb12u1  (won't fix)  deb   CVE-2025-32414    High        
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-32415    High        
perl                5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        
perl-base           5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        
perl-modules-5.36   5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High

However there are no minimal nor standard images for 17.5, only postgresql:17.5-1-bookworm, with a lot more vulnerabilities, with critical ones:

❯  grype --by-cve ghcr.io/cloudnative-pg/postgresql:17.5-1-bookworm | grep -E "High|Critical"                                                                                                                                                  
 ✔ Loaded image                                                                                                                                                                           ghcr.io/cloudnative-pg/postgresql:17.5-1-bookworm   
 ✔ Parsed image                                                                                                                                                     sha256:844e79e6bd624c302bd29b8dcd946573e8450e23f80a154f46683b7513a99884   
 ✔ Cataloged contents                                                                                                                                                      47dccb4afee948558efa40141eb93c173efd9812cb9774866dc696ed45b76c23   
   ├── ✔ Packages                        [219 packages]                                                                                                                                                                                       
   ├── ✔ File metadata                   [9,642 locations]                                                                                                                                                                                    
   ├── ✔ Executables                     [1,014 executables]                                                                                                                                                                                  
   └── ✔ File digests                    [9,642 files]                                                                                                                                                                                        
 ✔ Scanned for vulnerabilities     [232 vulnerability matches]     
   ├── by severity: 8 critical, 44 high, 53 medium, 23 low, 100 negligible (4 unknown)
   └── by status:   59 fixed, 173 not-fixed, 0 ignored (1 dropped)
libexpat1              2.5.0-1+deb12u1          (won't fix)                    deb        CVE-2023-52425    High        
libexpat1              2.5.0-1+deb12u1          (won't fix)                    deb        CVE-2024-8176     High        
libldap-2.5-0          2.5.13+dfsg-5            (won't fix)                    deb        CVE-2023-2953     High        
libperl5.36            5.36.0-7+deb12u2         (won't fix)                    deb        CVE-2023-31484    High        
libxml2                2.9.14+dfsg-1.3~deb12u1                                 deb        CVE-2022-49043    High        
libxml2                2.9.14+dfsg-1.3~deb12u1  (won't fix)                    deb        CVE-2024-25062    High        
libxml2                2.9.14+dfsg-1.3~deb12u1                                 deb        CVE-2024-56171    High        
libxml2                2.9.14+dfsg-1.3~deb12u1                                 deb        CVE-2025-24928    High        
libxml2                2.9.14+dfsg-1.3~deb12u1                                 deb        CVE-2025-27113    High        
libxml2                2.9.14+dfsg-1.3~deb12u1  (won't fix)                    deb        CVE-2025-32414    High        
libxml2                2.9.14+dfsg-1.3~deb12u1                                 deb        CVE-2025-32415    High        
perl                   5.36.0-7+deb12u2         (won't fix)                    deb        CVE-2023-31484    High        
perl-base              5.36.0-7+deb12u2         (won't fix)                    deb        CVE-2023-31484    High        
perl-modules-5.36      5.36.0-7+deb12u2         (won't fix)                    deb        CVE-2023-31484    High        
stdlib                 go1.18.2                 1.21.0-0                       go-module  CVE-2023-24531    Critical    
stdlib                 go1.18.2                 *1.19.8, 1.20.3                go-module  CVE-2023-24538    Critical    
stdlib                 go1.18.2                 *1.19.9, 1.20.4                go-module  CVE-2023-24540    Critical    
stdlib                 go1.18.2                 *1.19.10, 1.20.5               go-module  CVE-2023-29402    Critical    
stdlib                 go1.18.2                 *1.19.10, 1.20.5               go-module  CVE-2023-29404    Critical    
stdlib                 go1.18.2                 *1.19.10, 1.20.5               go-module  CVE-2023-29405    Critical    
stdlib                 go1.18.2                 *1.21.11, 1.22.4               go-module  CVE-2024-24790    Critical    
stdlib                 go1.18.2                 *1.23.8, 1.24.2                go-module  CVE-2025-22871    Critical    
stdlib                 go1.18.2                 1.18.6                         go-module  CVE-2022-27664    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-28131    High        
stdlib                 go1.18.2                 *1.18.7, 1.19.2                go-module  CVE-2022-2879     High        
stdlib                 go1.18.2                 *1.18.7, 1.19.2                go-module  CVE-2022-2880     High        
stdlib                 go1.18.2                 1.17.11, *1.18.3               go-module  CVE-2022-30580    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-30630    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-30631    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-30632    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-30633    High        
stdlib                 go1.18.2                 1.17.12, *1.18.4               go-module  CVE-2022-30635    High        
stdlib                 go1.18.2                 1.17.13, *1.18.5               go-module  CVE-2022-32189    High        
stdlib                 go1.18.2                 *1.18.7, 1.19.2                go-module  CVE-2022-41715    High        
stdlib                 go1.18.2                 1.19.6                         go-module  CVE-2022-41723    High        
stdlib                 go1.18.2                 1.19.6                         go-module  CVE-2022-41724    High        
stdlib                 go1.18.2                 1.19.6                         go-module  CVE-2022-41725    High        
stdlib                 go1.18.2                 *1.19.8, 1.20.3                go-module  CVE-2023-24534    High        
stdlib                 go1.18.2                 *1.19.8, 1.20.3                go-module  CVE-2023-24536    High        
stdlib                 go1.18.2                 *1.19.8, 1.20.3                go-module  CVE-2023-24537    High        
stdlib                 go1.18.2                 *1.19.9, 1.20.4                go-module  CVE-2023-24539    High        
stdlib                 go1.18.2                 *1.19.9, 1.20.4                go-module  CVE-2023-29400    High        
stdlib                 go1.18.2                 *1.19.10, 1.20.5               go-module  CVE-2023-29403    High        
stdlib                 go1.18.2                 *1.20.9, 1.21.2                go-module  CVE-2023-39323    High        
stdlib                 go1.18.2                 *1.20.10, 1.21.3               go-module  CVE-2023-44487    High        
stdlib                 go1.18.2                 *1.20.12, 1.21.5               go-module  CVE-2023-45285    High        
stdlib                 go1.18.2                 1.20.0                         go-module  CVE-2023-45287    High        
stdlib                 go1.18.2                 *1.21.9, 1.22.2                go-module  CVE-2023-45288    High        
stdlib                 go1.18.2                 *1.21.8, 1.22.1                go-module  CVE-2024-24784    High        
stdlib                 go1.18.2                 *1.21.12, 1.22.5               go-module  CVE-2024-24791    High        
stdlib                 go1.18.2                 *1.22.7, 1.23.1                go-module  CVE-2024-34156    High        
stdlib                 go1.18.2                 *1.22.7, 1.23.1                go-module  CVE-2024-34158    High

I found postgresql:17.5-1-bookworm from https://raw.githubusercontent.com/cloudnative-pg/postgres-containers/main/Debian/ClusterImageCatalog-bookworm.yaml.

Maybe the process for minimal and standard images is using a newer golang to create them, resulting removing all golang vulnerabilities, probably related to #126 and #132.

Any thoughts or direction ?
Thanks.
@dosubot DosuBot
Copy link

dosubot bot commented May 13, 2025

Hello @c35sys! I'm Dosu, a bot here to help you solve bugs, answer questions, and guide you on your journey to becoming a contributor. I'm ready to assist while you wait for a human maintainer. How can I help you today?

The 'minimal' and 'standard' images for PostgreSQL 17.5 are not currently available, which might be contributing to the higher number of vulnerabilities in the postgresql:17.5-1-bookworm image. The 'minimal' and 'standard' images are typically built to be more lightweight and may exclude some of the components that contribute to vulnerabilities.

The process for building these images involves using Docker Bake, which allows for specific configurations and dependencies to be set, potentially reducing vulnerabilities. The 'minimal' images are based on official Debian images and include only essential PostgreSQL components, while 'standard' images extend these with additional features like PGAudit and pgvector [1].

Regarding the Go version, it seems that the vulnerabilities in the postgresql:17.5-1-bookworm image might be related to the Go version used. However, there is no specific information available about the Go version used in this image or plans to update it to address vulnerabilities [1].

To reduce vulnerabilities, you might consider building a custom image using the Docker Bake process, specifying a newer Go version if possible. This could help mitigate some of the vulnerabilities related to Go.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot dosubot bot added the question Further information is requested label May 13, 2025
@c35sys c35sys changed the title minimal and standard images for 17.5 [vulnerabilities] minimal and standard images for 17.5 May 13, 2025
@sxd
Copy link
Member

sxd commented May 15, 2025

Hello @c35sys

The old set of images depending from the Docker Hub postgres images install a lot of things that we remove on the minimal and standard set, those images with the Docker Hub postgres base image are being deprecated and slowly going out.

The new version 17.5 is in build process because we didn't update so it will be available.

Related to security issues, sadly the base image (debian) comes with security issues that most of the time can't be fixed or require a new version of the base image, this most of the time is fixed, but it can happens that requires a build.

Regards,

@sxd sxd self-assigned this May 15, 2025
@c35sys
Copy link
Author

c35sys commented May 15, 2025

Hello @sxd , thanks for the explanation !

I found new images for 17.5 and test the standard one:

❯ grype --by-cve ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm | grep -E "High|Critical"
 ✔ Vulnerability DB                [updated]  
 ✔ Pulled image                    
 ✔ Loaded image                                                                                                                                                                    ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm 
 ✔ Parsed image                                                                                                                                                     sha256:666ffd8e846bb963d6643ca1e4fd81359d028faf54f83adccae4faadae9044db 
 ✔ Cataloged contents                                                                                                                                                      eb5b03b361e7174835dfbe709fb70c26cfab6a5ec6eae352233ba1e5aaaa6b6c 
   ├── ✔ Packages                        [148 packages]  
   ├── ✔ Executables                     [934 executables]  
   ├── ✔ File metadata                   [10,245 locations]  
   └── ✔ File digests                    [10,245 files]  
 ✔ Scanned for vulnerabilities     [165 vulnerability matches]  
   ├── by severity: 0 critical, 12 high, 28 medium, 17 low, 104 negligible (4 unknown)
   └── by status:   0 fixed, 165 not-fixed, 0 ignored (1 dropped)
libperl5.36         5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        76.11    0.8  
perl                5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        76.11    0.8  
perl-base           5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        76.11    0.8  
perl-modules-5.36   5.36.0-7+deb12u2         (won't fix)  deb   CVE-2023-31484    High        76.11    0.8  
libldap-2.5-0       2.5.13+dfsg-5            (won't fix)  deb   CVE-2023-2953     High        76.39    0.8  
libxml2             2.9.14+dfsg-1.3~deb12u1  (won't fix)  deb   CVE-2024-25062    High        30.75  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-27113    High        15.51  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-32415    High        13.68  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1  (won't fix)  deb   CVE-2025-32414    High         9.11  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2022-49043    High         4.70  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2025-24928    High         0.41  < 0.1  
libxml2             2.9.14+dfsg-1.3~deb12u1               deb   CVE-2024-56171    High         0.32  < 0.1

Will they be available at each version ? As they have far less vulnerabilities, don't you think they should be the default in https://raw.githubusercontent.com/cloudnative-pg/postgres-containers/main/Debian/ClusterImageCatalog-bookworm.yaml ?

Regards

@sxd
Copy link
Member

sxd commented May 16, 2025

Hello

In the README.md of this repo is explained why that's not possible yet https://github.com/cloudnative-pg/postgres-containers?tab=readme-ov-file#system-images a lot of people is not using the plugin.

Regards,

@c35sys
Copy link
Author

c35sys commented May 16, 2025

Thanks for the note it makes perfect sense, I missed the Barman plugin difference between them.

I'll use minimal or standard images for now, thank again !

Best regards

@c35sys c35sys closed this as completed May 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@sxd sxd

Labels
question Further information is requested
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@c35sys @sxd