bitcoind image v27.2 contains multiple critical and high vulnerabilities

[antonr-p2p]

Please find more details attached.
I hope it should be possible to just rebuild current image with the latest base one.
Both v27.2 and v28.0 images were released ~6 months ago and these critical/high vulns are 4-5 months old.

bitcoind-27.2.pdf

[AaronDewes]

I'll check what I can do, but none of these vulns seem exploitable.

This is not a "critical issue", but rather low-priority.

The repository is not really actively maintained at the moment, maybe you can also try this fork: https://github.com/lnliz/docker-bitcoind.

[lnliz]

Thank you Aaron for all your work. I maintain lnliz/docker-bitcoind and I pushed an update for the docker images for 26.2, 27.2, 28.0 to update alpine, hope that helps.

And I agree with Aaron, this are not critical issue but robot generated pdf reports so only low-priority.

[Goro2030]

@lnliz , did this impact the latest version , or just those that you mentioned ( 26.2, 27.2 and 28 ) ?

[lnliz]

No idea, @antonr-p2p can know with his generated pdf reports.

[antonr-p2p]

@Goro2030 as I mentioned in subject
Both v27.2 and v28.0 images were released ~6 months ago and these critical/high vulns are 4-5 months old.
So basically rebuilding using latest OS image/packages and dependencies should fix it.