<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Matt,</p>
<p><br>
</p>
<p>Several potential solutions:</p>
<p><br>
</p>
<p>1) Regenerate the Docker image from sources:</p>
<p><br>
</p>
<p>git clone <a class="moz-txt-link-freetext" href="https://github.com/OSGeo/gdal">https://github.com/OSGeo/gdal</a></p>
<p>cd gdal</p>
<p>./docker/ubuntu-full/build.sh<br>
</p>
<p><br>
</p>
<p>2) Same as 1), but before edit ./docker/ubuntu-full/Dockerfile to
remove all traces of java/jdk from it</p>
<p><br>
</p>
<p>3) Use the existing image, remove the openjdk package, and
"flatten" the Docker layers with docker export / docker import (cf
<a class="moz-txt-link-freetext" href="https://forums.docker.com/t/how-to-flatten-an-image-with-127-parents/1600/2">https://forums.docker.com/t/how-to-flatten-an-image-with-127-parents/1600/2</a>),
so that the layer where it was installed disappears</p>
<p><br>
</p>
<p>4) Wait a couple hours while I'm regenerating it to be updated to
<tt style="word-break: break-word;">17.0.12+7-1ubuntu2~24.04</tt></p>
<p><br>
</p>
<p>Even<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">Le 09/09/2024 à 19:29, Matt Luck - NOAA
Affiliate via gdal-dev a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:CO1PR10MB457818D07657F4627A20DD06FE992@CO1PR10MB4578.namprd10.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<style type="text/css" style="display:none;">P {margin-top:0;margin-bottom:0;}</style>
<div class="elementToProof"
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi, our IT department has detected a security vulnerability in
the Java JDK version 17 that's installed in the ubuntu-full
docker image (see message below). I am able to remove the Java
files from the Docker image via the Dockerfile and I've tried
changing the `JAVA_VERSION` in the Dockerfile, but there always
seems to be a reference remaining in the Docker diff files that
I can't seem to get rid of.</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
To reproduce:</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
A `docker system prune -a -f`, then `sudo find
/var/lib/docker/overlay2 -type d -name java-17-openjdk-amd64`
finds nothing, but then `docker pull
ghcr.io/osgeo/gdal:ubuntu-full-3.9.1` followed by `sudo find
/var/lib/docker/overlay2 -type d -name
java-17-openjdk-amd64` finds:<br>
/var/lib/docker/overlay2/1d5a9f2712fb9b28bfa857509a45fb334005cda0ea58fea8a259af8eb3fcb2db/diff/usr/lib/jvm/java-17-openjdk-amd64</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
/var/lib/docker/overlay2/1d5a9f2712fb9b28bfa857509a45fb334005cda0ea58fea8a259af8eb3fcb2db/diff/usr/lib/debug/usr/lib/jvm/java-17-openjdk-amd64</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
/var/lib/docker/overlay2/1d5a9f2712fb9b28bfa857509a45fb334005cda0ea58fea8a259af8eb3fcb2db/diff/usr/share/gdb/auto-load/usr/lib/jvm/java-17-openjdk-amd64</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof"
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Because they're diff files, those files exist whether or not
they're actually in the container and thus the vulnerability is
always triggered. Is there a solution and/or a way to either
upgrade the Java version or remove Java entirely if it's not
needed so that we can deal with this issue in the future?</div>
<div
style="text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
On Mon, Jul 8, 2024 at 10:21 AM X wrote:</div>
<blockquote
style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left: 1px solid rgb(204, 204, 204);">
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
All,</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Please see the vulns below and remediate as soon as possible.
These are in containers.</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Path : /var/lib/docker/overlay2/<wbr
style="color:rgb(0, 0, 0)">48c2e3da9fc2282822d4522e28ca46<wbr
style="color:rgb(0, 0, 0)">788f5357a14a8a38f687e2cadbf9de<wbr
style="color:rgb(0, 0, 0)">68d7/diff/usr/lib/jvm/java-17-<wbr
style="color:rgb(0, 0, 0)">openjdk-amd64/<br>
Installed version : 17.0.8<br>
Fixed version : Upgrade to a version greater than
17.0.10<br>
<br>
</div>
<div
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Path : /var/lib/docker/overlay2/<wbr
style="color:rgb(0, 0, 0)">4aed72b0f0433c615afe67854c8c79<wbr
style="color:rgb(0, 0, 0)">bb7acca2fb01216bf6be2577418026<wbr
style="color:rgb(0, 0, 0)">6f4d/diff/usr/lib/jvm/java-17-<wbr
style="color:rgb(0, 0, 0)">openjdk-amd64/<br>
Installed version : 17.0.8<br>
Fixed version : Upgrade to a version greater than
17.0.10</div>
</blockquote>
<div class="elementToProof"
style="direction: ltr; text-align: left; text-indent: 0px; margin: 0px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
gdal-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:gdal-dev@lists.osgeo.org">gdal-dev@lists.osgeo.org</a>
<a class="moz-txt-link-freetext" href="https://lists.osgeo.org/mailman/listinfo/gdal-dev">https://lists.osgeo.org/mailman/listinfo/gdal-dev</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
<a class="moz-txt-link-freetext" href="http://www.spatialys.com">http://www.spatialys.com</a>
My software is free, but my time generally not.</pre>
</body>
</html>