-
-
Notifications
You must be signed in to change notification settings - Fork 567
Security vulnerability fixes and multi arch support#763
Security vulnerability fixes and multi arch support #763sukalpomitra wants to merge 2 commits intosismics:master from
Conversation
Dockerfile
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you merge this with the previous command?
Also, what is this package for?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hi @jendib libgnutls30 is a package in the GnuTLS library suite, specifically version 3. GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols. The primary purpose of libgnutls30 is to provide support for cryptographic algorithms and protocols necessary to secure network communications.
I think this package is used by the OS internally in the version used as it popped in the security vulnerability.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
also merged the command to above line
sukalpomitra
commented
Sep 7, 2024
HI @jendib this has been in this state for quite some time. Can you please do another review?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Here the log4j version is upgraded to the major version 2, and reload4j is a log4j 1 fork, so there is a problem.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is going to break all existing instances using h2 database.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @jendib we have been working with this version of h2 in our forked teedy without any issues. However let me know and I can revert both this and the log4j version change. But there will still be vulnerabilities for these older versions
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- double "&&"
- no log when docer logs -f teedy after merge changes
Hi @jendib this PR consists vulnerability fixes and multi arch support