AWS ECS scan Critical vulnerability in Docker Image version 1.12.0

[joao reigota]

Hi,
After running an AWS ECS scan on top of ZAP docker image v1.12.0, a CRITICAL issue appeared as well as HIGH results

CVE-2019-19814 in package linux:5.10.158-2 (CRITICAL)

Thank you,
João Reigota

[Simon Bennetts]

From https://nvd.nist.gov/vuln/detail/CVE-2019-19814 :

• In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem image can cause __remove_dirty_segment slab-out-of-bounds write access because an array is bounded by the number of dirty types (8) but the array index can exceed this.

ZAP doesnt mount filesystems.

If you dont mount crafted f2fs filesystems on the ZAP image then I dont see how this could be a problem.

If anyone can think of a way this can be realistically a problem then let us know asap.

We update the stable docker image at the start of the month as per https://www.zaproxy.org/docs/docker/about/#stable

I dont see any reason to bring that forward right now.

Cheers,

Simon

[joao reigota]

I am sorry I wrote the wrong version is not 1.12.0 it is 2.12.0

Thank you,
João Reigota

[Simon Bennetts]

Yeah, I guessed ;)

But my previous response still stands.