{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/docker-node/issues/560","repository_url":"https://api.github.com/repos/nodejs/docker-node","labels_url":"https://api.github.com/repos/nodejs/docker-node/issues/560/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/docker-node/issues/560/comments","events_url":"https://api.github.com/repos/nodejs/docker-node/issues/560/events","html_url":"https://github.com/nodejs/docker-node/issues/560","id":269284151,"number":560,"title":"node:6-alpine contains a security vulnberability","user":{"login":"IdanAdar","id":7255583,"avatar_url":"https://avatars0.githubusercontent.com/u/7255583?v=4","gravatar_id":"","url":"https://api.github.com/users/IdanAdar","html_url":"https://github.com/IdanAdar","followers_url":"https://api.github.com/users/IdanAdar/followers","following_url":"https://api.github.com/users/IdanAdar/following{/other_user}","gists_url":"https://api.github.com/users/IdanAdar/gists{/gist_id}","starred_url":"https://api.github.com/users/IdanAdar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/IdanAdar/subscriptions","organizations_url":"https://api.github.com/users/IdanAdar/orgs","repos_url":"https://api.github.com/users/IdanAdar/repos","events_url":"https://api.github.com/users/IdanAdar/events{/privacy}","received_events_url":"https://api.github.com/users/IdanAdar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-10-28T05:07:56Z","updated_at":"2017-10-28T16:57:08Z","closed_at":null,"author_association":"NONE","body":"The following vulnerability was discovered:\r\n```\r\nmusl      musl libc before 1.1.17 has a buffer overflow via crafted DNS replies because dns_parse_callback in network/lookup_name.c does not restrict the number of addresses, and thus an attacker can provide an unexpected number by sending A records in a reply to an AAAA query.\r\n```\r\nIn trying to resolved it I ran `docker build -t myimage:mytag .` to get the latest version, using the following Dockerfile:\r\n```\r\nFROM node:6-alpine\r\n\r\n# Add build tools\r\nRUN apk add --no-cache make \\\r\n    python \\\r\n    g++\r\n```\r\nHowever, this fails like so: \r\n```\r\nSending build context to Docker daemon  2.048kB\r\nStep 1/2 : FROM node:6-alpine\r\n ---> 1423d341c132\r\nStep 2/2 : RUN apk add --no-cache make     python     g++\r\n ---> Running in babbdc62f0ba\r\nfetch http://dl-cdn.alpinelinux.org/alpine/v3.4/main/x86_64/APKINDEX.tar.gz\r\nfetch http://dl-cdn.alpinelinux.org/alpine/v3.4/community/x86_64/APKINDEX.tar.gz\r\n(1/25) Installing binutils-libs (2.26-r1)\r\nERROR: binutils-libs-2.26-r1: Protocol error\r\n(2/25) Installing binutils (2.26-r1)\r\n(3/25) Installing gmp (6.1.0-r0)\r\n(4/25) Installing isl (0.14.1-r0)\r\n(5/25) Installing libgomp (5.3.0-r0)\r\n(6/25) Installing libatomic (5.3.0-r0)\r\n(7/25) Installing pkgconf (0.9.12-r0)\r\n(8/25) Installing pkgconfig (0.25-r1)\r\n(9/25) Installing mpfr3 (3.1.2-r0)\r\nERROR: mpfr3-3.1.2-r0: Protocol error\r\n(10/25) Installing mpc1 (1.0.3-r0)\r\n(11/25) Installing gcc (5.3.0-r0)\r\nERROR: gcc-5.3.0-r0: Protocol error\r\n(12/25) Installing musl-dev (1.1.14-r16)\r\n(13/25) Installing libc-dev (0.7-r0)\r\n(14/25) Installing g++ (5.3.0-r0)\r\nERROR: Failed to create usr/libexec/gcc/x86_64-alpine-linux-musl/5.3.0/cc1plus: No space left on device\r\nERROR: g++-5.3.0-r0: No space left on device\r\n(15/25) Installing make (4.1-r1)\r\n(16/25) Installing libbz2 (1.0.6-r5)\r\n(17/25) Installing expat (2.2.0-r1)\r\n(18/25) Installing libffi (3.2.1-r2)\r\n(19/25) Installing gdbm (1.11-r1)\r\n(20/25) Installing ncurses-terminfo-base (6.0_p20170701-r0)\r\n(21/25) Installing ncurses-terminfo (6.0_p20170701-r0)\r\n(22/25) Installing ncurses-libs (6.0_p20170701-r0)\r\n(23/25) Installing readline (6.3.008-r4)\r\n(24/25) Installing sqlite-libs (3.13.0-r1)\r\n(25/25) Installing python (2.7.12-r0)\r\nExecuting busybox-1.24.2-r13.trigger\r\n4 errors; 72 MiB in 34 packages\r\nThe command '/bin/sh -c apk add --no-cache make     python     g++' returned a non-zero code: 4\r\n```\r\nAfter some googling the suggestion is to update to Alpine 3.6. I believe `node:6-alpine` uses Alpine 3.4. Could someone suggestion a solution?"},"comment":{"url":"https://api.github.com/repos/nodejs/docker-node/issues/comments/340204859","html_url":"https://github.com/nodejs/docker-node/issues/560#issuecomment-340204859","issue_url":"https://api.github.com/repos/nodejs/docker-node/issues/560","id":340204859,"user":{"login":"SimenB","id":1404810,"avatar_url":"https://avatars1.githubusercontent.com/u/1404810?v=4","gravatar_id":"","url":"https://api.github.com/users/SimenB","html_url":"https://github.com/SimenB","followers_url":"https://api.github.com/users/SimenB/followers","following_url":"https://api.github.com/users/SimenB/following{/other_user}","gists_url":"https://api.github.com/users/SimenB/gists{/gist_id}","starred_url":"https://api.github.com/users/SimenB/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SimenB/subscriptions","organizations_url":"https://api.github.com/users/SimenB/orgs","repos_url":"https://api.github.com/users/SimenB/repos","events_url":"https://api.github.com/users/SimenB/events{/privacy}","received_events_url":"https://api.github.com/users/SimenB/received_events","type":"User","site_admin":false},"created_at":"2017-10-28T16:57:08Z","updated_at":"2017-10-28T16:57:08Z","author_association":"CONTRIBUTOR","body":"I meant you have to build the node image from scratch. Copy https://github.com/nodejs/docker-node/blob/03cdabff6dcce8c7edbc4f1254269ae41f269dd8/6.11/alpine/Dockerfile and change the `FROM` in that.\r\n\r\nOr send a PR to us to allow us to have both alpine 3.4 and alpine 3.6 here 🙂 "}}
{"actor":{"display_login":"SimenB"}}