Vulnerable

[cmavr8]

Great docker.
But it still uses libc 2.19-0ubuntu6.6, which is vulnerable. I made a fresh install but it still uses that version. Do you think it's a matter of Dockerfile?

Source

[rastasheep]

Thanks for reporting!

It should be meter of base image, in this case i've used official Ubuntu ones. Those images are fixed and updated yesterday, according this issue, which should automatically trigger fresh build of this repo.

Can you try to pull newest version of rastasheep/ubuntu-sshd and check it again?
Thanks

[cmavr8]

Thanks for the reply!

That's exactly what I thought, but it didn't work earlier.
I tried again a few hours ago, but still get the old libc.

For the record, I'm doing:

docker pull rastasheep/ubuntu-sshd

docker stop docker_sshd

docker rm -f docker_sshd

docker run ....(all my options)

docker exec -i -t docker_sshd bash

dpkg -l |grep libc-bin

And I get:

ii libc-bin 2.19-0ubuntu6.6 amd64 Embedded GNU C Library: Binaries

This is most probably due to me doing something wrong or the upstream image. Not ubuntu-sshd. But anyone is welcome to help me :)

[rastasheep]

You're mentioning docker_sshd, full name of this image is rastasheep/ubuntu-sshd, maybe you're running wrong container.

Btw make sure that you're running 12.04 or 14.04 (latest) tag, There is some issues with building 13.10 12.10 and 13.04 tags. I'll inspect them later today.

[cmavr8]

docker_sshd is the name I give it (in the docker run command). I tried changing it, to make sure I'm using a recent image, but still getting 6.6. Using 14.04.

[cmavr8]

I found the culprit! I was using the 14.04 tag. Changing to "latest" fixed it!

[rastasheep]

Tnx for the info. I'll definitely give more attention to this project in the short future, to add new versions and check situation with older ones.