From a3dadc878d25d3dd648c2814120234e1aedddb0c Mon Sep 17 00:00:00 2001 From: "Mahadik, Mukul Chandrakant" Date: Thu, 12 Oct 2023 16:24:01 -0700 Subject: [PATCH 1/2] Fixing vulnerabilities in Docker images Fixes to vulnerabilities found in Docker images in AWS ECR. Busybox package - Upgraded packages to latest version using suggested command. --- frontend/Dockerfile.dev | 2 ++ 1 file changed, 2 insertions(+) diff --git a/frontend/Dockerfile.dev b/frontend/Dockerfile.dev index 60b3cb2..09c4d38 100644 --- a/frontend/Dockerfile.dev +++ b/frontend/Dockerfile.dev @@ -5,5 +5,7 @@ WORKDIR /public RUN npm i -g http-server +RUN apk update && apk upgrade busybox + EXPOSE 5050 CMD ["http-server", "-p", "5050"] From a8f5cdd5a871ac81cc118efad9fd26b0d75749ba Mon Sep 17 00:00:00 2001 From: "Mahadik, Mukul Chandrakant" Date: Thu, 12 Oct 2023 16:37:14 -0700 Subject: [PATCH 2/2] Upgrading npm as well as dependencies Contains fix for vulnerability issue for semver package dependency. - Upgraded to v.7.5.4 by upgrading the npm package itself along with its dependencies. --- frontend/Dockerfile | 3 +++ frontend/Dockerfile.dev | 1 + 2 files changed, 4 insertions(+) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index b49a422..1249fef 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -5,6 +5,9 @@ WORKDIR /public RUN npm i -g http-server +RUN apk update && apk upgrade busybox +RUN npm update -g + COPY client /public/client COPY *.html /public/ COPY i18n /public/i18n diff --git a/frontend/Dockerfile.dev b/frontend/Dockerfile.dev index 09c4d38..16823a6 100644 --- a/frontend/Dockerfile.dev +++ b/frontend/Dockerfile.dev @@ -6,6 +6,7 @@ WORKDIR /public RUN npm i -g http-server RUN apk update && apk upgrade busybox +RUN npm update -g EXPOSE 5050 CMD ["http-server", "-p", "5050"]