[Snyk] Security upgrade python from 3.9-slim to 3.13-slim #128
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-DEBIAN12-ZLIB-6008963 - https://snyk.io/vuln/SNYK-DEBIAN12-GCC12-2606941 - https://snyk.io/vuln/SNYK-DEBIAN12-GCC12-5901316 - https://snyk.io/vuln/SNYK-DEBIAN12-GCC12-5901316 - https://snyk.io/vuln/SNYK-DEBIAN12-KRB5-6277421
|
![prisma-cloud-devsecops[bot]](https://avatars.githubusercontent.com/in/135857?s=60&v=4){kind=small}
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
A user for the container has not been created
Resource: /docker/Dockerfile.python-3.9. | Checkov ID: CKV_DOCKER_3
Description
The policy's primary purpose is to verify that a dedicated user has been explicitly created for running the container. This is essential to avoid running the container with root privileges, which could introduce significant security risks in case of a compromise. Running containers as a non-root user reduces the potential impact of a security breach.
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
Healthcheck instructions have not been added to container images
Resource: /docker/Dockerfile.python-3.9. | Checkov ID: CKV_DOCKER_2
Description
We recommend that you add the HEALTHCHECK instruction to your Docker container images to ensure that health checks are executed against running containers.
An important security control is that of availability.
Adding the HEALTHCHECK instruction to your container image ensures that the Docker engine periodically checks the running container instances against that instruction to ensure that containers are still operational.
Based on the results of the health check, the Docker engine could terminate containers which are not responding correctly, and instantiate new ones.
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
libgcrypt20 1.10.1-3 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 1
| Critical: 0 | High: 0 | Medium: 0 | Low: 1 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2024-2236 |  LOW |
- | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
shadow 1:4.13+dfsg1-1 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 2
| Critical: 0 | High: 0 | Medium: 0 | Low: 2 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2023-29383 | LOW |
3.3 | - |
Open |
| CVE-2023-4641 | LOW |
5.5 | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
pam 1.5.2-6+deb12u1 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 1
| Critical: 0 | High: 0 | Medium: 0 | Low: 1 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2024-22365 | LOW |
5.5 | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
ncurses 6.4-4 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 2
| Critical: 0 | High: 0 | Medium: 0 | Low: 2 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2023-45918 | LOW |
- | - |
Open |
| CVE-2023-50495 | LOW |
6.5 | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
sqlite3 3.40.1-2 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 1
| Critical: 0 | High: 0 | Medium: 0 | Low: 1 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2023-7104 | LOW |
7.3 | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
perl 5.36.0-7+deb12u1 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 1
| Critical: 0 | High: 0 | Medium: 0 | Low: 1 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2023-31484 | LOW |
8.1 | - |
Open |
| @@ -1,4 +1,4 @@ | |||
| FROM python:3.9-slim | |||
| FROM python:3.13-slim | |||
There was a problem hiding this comment.
pip 24.2 / Dockerfile.python-3.9.FROM
Total vulnerabilities: 1
| Critical: 0 | High: 1 | Medium: 0 | Low: 0 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| PRISMA-2022-0168 |  HIGH |
7.8 | - |
Open |
Snyk has created this PR to fix 4 vulnerabilities in the dockerfile dependencies of this project.
Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.
Snyk changed the following file(s):
docker/Dockerfile.python-3.9We recommend upgrading to
python:3.13-slim, as this image has only 37 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.Vulnerabilities that will be fixed with an upgrade:
SNYK-DEBIAN12-ZLIB-6008963
SNYK-DEBIAN12-GCC12-2606941
SNYK-DEBIAN12-GCC12-5901316
SNYK-DEBIAN12-GCC12-5901316
SNYK-DEBIAN12-KRB5-6277421
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.