[Security] Any action required for CVE-2015-7547?

[PikachuEXE]

Recently a security related CVE is published
https://www.kb.cert.org/vuls/id/457759

There is already an issue for docker official images
docker-library/official-images#1448

Anything required for this repo? Rebuild? Change of Dockerfiles/scripts?

[FooBarWidget]

We'll update it eventually. In the mean time, you can run apt-get update && apt-get upgrade in your Dockerfile which does the same thing: /~https://github.com/phusion/baseimage-docker#upgrading_os

[PikachuEXE]

Thanks
Should I keep this issue open?
Also the link should be /~https://github.com/phusion/baseimage-docker#upgrading-the-operating-system-inside-the-container (Yup I know it will be outdated again soon enough)

[FooBarWidget]

Yes please do.

#upgrading_os works too. We have different anchor names in the readme.

[asokani]

Is the apt-get upgrade really bulletproof? Official Docker documentation discourages this practice. See https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/#apt-get

.. avoid apt-get upgrade ..., as many of the “essential” packages from the base images won’t upgrade inside an unprivileged container

Just asking. Is that an issue? Do anyone know which packages "won't upgrade"?

[FooBarWidget]

I don't think it's a big issue.

Things like kernel packages or bootloader packages (grub) won't upgrade because they try to do things that require more privileges. But I think the document is exaggerating when they say that "many packages won't upgrade" -- I have yet to encounter even one case of a package not upgrading well due to lack of privileges. I think the kernel and bootloader packages are already disabled in the Docker base images.

And what that article says about upgrading applies equally to installing. If a package won't upgrade inside an unprivileged container, then it won't install either, so you would have noticed the issue long before you needed to upgrade.

[asokani]

Thanks. Sounds reasonable. Another idea: I searched github for filename:Dockerfile "apt-get" with 113 000 results and then for filename:Dockerfile "apt-get upgrade" with 8000 results. It works for many others.

[FooBarWidget]

We've recently updated Baseimage-docker to Ubuntu 16.04. So the security update will also be released real soon now.