alpine:latest has CVE-2019-14697

[tgerlach]

Vulnerable Packages Found
=========================

Vulnerability ID   Policy Status   Affected Packages   How to Resolve
CVE-2019-14697     Active          musl                Upgrade musl to >= 1.1.22-r3

[tianon]

More specifically, all supported versions 3.7 - 3.10 are affected:

• alpine:3.10.1: musl=1.1.22-r2 fixed by 1.1.22-r3
• alpine:3.9.4: musl=1.1.20-r4 fixed by 1.1.20-r5
• alpine:3.8.4: musl=1.1.19-r10 fixed by 1.1.19-r11
• alpine:3.7.3: musl=1.1.18-r3 fixed by 1.1.18-r4

[ncopa]

Please note that this only affects 32 bit x86 (aka i386).

[mizeng]

how to resolve this? Could we have a new version of alpine?

[ncopa]

alpine:3.10/alpine:latest is fixed with docker-library/official-images@6122677

[ncopa]

Users who are using 32 bit images can do apk upgrade -U til new release are made for alpine:3.9, alpine:3.8 and alpine:3.7.

[camp-007]

Is the intention to patch 3.9 (or other versions) as well? Or will we be required to update the minor version to receive this?

[ingokofler]

@ncopa is 3.9 still maintained?

This overview https://wiki.alpinelinux.org/wiki/Alpine_Linux:Releases is giving me the impression that I will still get security fixes until November 2020 but as it seems this is not the case. What's the official strategy on providing bugfixes for Docker images?