CURL vulnerabilities

[lenisha]

Steps to reproduce the issue

1. Use mcr.microsoft.com/dotnet/core/aspnet images
2. Dotnet images flagged with vulnerabilities in CURL package

Is it possible to remove curl from the image once donet sdk or runtime was installed?

[mthalman]

• Which specific image? Please provide the image tag.
• What vulnerability scanner is being used?
• What are the vulnerabilities that are being flagged?

[lenisha]

Tag: mcr.microsoft.com/dotnet/core/aspnet:2.2
AquaSecurity
https://curl.haxx.se/docs/vuln-7.52.0.html

[MichaelSimons]

@lenisha, Please upgrade to a supported version of .NET Core. 2.2 went EOL on Dec 23, 2019. See this blog post for details.

[MichaelSimons]

Looking outside of the specific scenario in which this issue was reported on, we think it makes sense to consider removing curl as well as ca-certificates from the runtime images. The motivating reasons are to reduce the attack surface area and to reduce the size of the images to help download and startup perf. It makes sense to keep them within the sdk images as those are tuned for development scenarios. This is considered a breaking change and therefore should only be done for the next . release which would be 5.0.

The original reason why curl was included is because these images were defined prior to Docker supporting multi-staged builds. Without multi-staged builds, it was necessary to acquire tools such as curl in order to download assets directly within Dockerfiles while adhering to the Dockerfile best practices which recommend not using cmds like ADD which have support for downloading artifacts.

[shouaib-ahmed]

The issue exists in all Debian Buster based Docker images regardless of .net version. See https://security-tracker.debian.org/tracker/source-package/curl . What is the best way to address this? The Alpine based images seem to be using wget instead of curl. I still prefer to use Debian based images as this is the default/recommended base Docker image.

[MichaelSimons]

We posted a Staying up-to-date with .NET Container Images blog post a while ago. In the Security Updates and Vulnerability Scanning section, we recommend using the Alpine images if you are concerned about vulnerabilities as it is the most secure offering.

In regards to the curl vulnerabilities in the Debian Buster images, the .NET images contain the latest stable curl version. There is a newer version offered in the testing channel that you could install as you see fit.

[MichaelSimons]

Closing - Curl has been removed from the images for the next release - 5.0.