Critical CVEs found in Metabase v0.63.3 due to out of date alpine version

Get Help
1

Hi all,

My org and I have rolled out an updated metabase docker from v50 (very old) to v63 to patch many critical and high CVEs. While this patched most of them, we have 8 new critical and 10 high CVEs, which block deployment. All 8 of the critical vulnerabilities were due to curl being on 8.20.0-r0 while the fixed version is 8.21.0. This is in alpine 3.24+, while metabase still uses 3.23.5. Is there any fix I can do to our wrapper dockerfile to use the updated alpine? The wrapper simply pulls v0.63.3 from our private nexus and runs it. We don’t want to do anything that diverges a lot from the source code of metabase, it should be at most a simple workaround.

9 of the 10 high CVEs are due to this curl issue as well, except one which is org.apache.tika_tika-core being on 3.2.3 while the fix is in 3.3.2, which I assume can simply be bumped on the master branch of metabase.

So is there any waiting we’ll have to do for alpine 3.24 to be bumped? Or can I implement a workaround on Dockerfile. Thanks.

2

Can’t you just specify a version for the alpine dependency by version or hash?

In general its good practice to pin versions of things and not rely on “latest” tags.