mssql-docker
mssql-docker copied to clipboard
microsoft
The launchpad extension has critical security vulnerabilities in the latest images
The latest image of mssql/server:2022-latest contains a file at /opt/mssql-extensibility/bin/launchpad which appears to be built with a very old version of golang and generates a large number of critical CVE's for all of your published images.
exact sha256
as of Aug 27, 2024
c1aa8afe9b06eab64c9774a4802dcd032205d1be785b1fd51e1c0151e7586b74
Details
Please rebuild the launchpad extension with a newer version of golang and publish an updated version of 2022 and 2019.
- CVE-2023-29404
- CVE-2023-24540
- CVE-2019-14809
- CVE-2023-29402
- CVE-2023-24538
- CVE-2022-23806
- CVE-2021-38297
- CVE-2019-11888
- CVE-2023-29405
Related to
- https://github.com/microsoft/mssql-docker/issues/866
Ack. Thank you for sharing this. We will work on updating the golang package.
sorry for the delay, hopefully I should have a tentative timeline to share by end of next week.
Hi.
I am another person and team being completely paralyzed here.
When giving timeline phrases... could you use exact dates and please avoid "this week" or "next week" phrases. I'm not trying to be a jerk, but I'm getting pinged twice a day on "what is the update?". I am in a zero tolerance world now.
Thank you for your consideration.
@amitkh-msft I'm in the same boat. These images are being blocked by our security team and they are critical for our developers.
sorry for the delay, hopefully I should have a tentative timeline to share by end of next week.
(Posted 3 weeks ago)
Hi.
We are desperately looking for an update.
We are looking to shift to postgres now because of the lack of response.
I'm not trying to be nasty. I'm conveying the reality of our security department will not allow vulnerable images.
@amitkh-msft are there any updates on the timeline?
We have the same problem that several people have already described here: one of our products needs to use the mssql server image which contains the vulnerabilities stated above. As long as the vulnerabilities exist our security department does not allow going live with the product and blocks the usage of the image.
Hi. It's coming up on 2 MONTHS since being reported.
Please, can we get an update?
Hi, I have the same problem. For our company the image is blocked by security scanners. How long will it take to fix this critical issue? regards
4 1/2 MONTHS later...we still have no update?
This is embarrassing Microsoft.
Launchpad extension is now built with go version 1.23.1 with release of SQL Server 2022 CU17.
