2

I have been told one of my Docker images has "Docker security issue CVE-2017-12424", says one of its package shadow version is "1:4.4-4.1". And I need to upgrade. But I can only see version 1:4.4-4.1 of my Debian packages:

 $ dpkg -l | grep 1:4.4-4.1
ii  login                     1:4.4-4.1                      amd64        system login tools
ii  passwd                    1:4.4-4.1                      amd64        change and administer password and group data

I found the shadow github repo https://github.com/shadow-maint/shadow, but I didn't find any document related.

Can you please help me, and tell me about how to check shadow's package version, and how to upgrade it in a Debian environment.

Improve this question
2
  • What are your Docker images based on? (The FROM lines in your Dockerfiles.)
    – Stephen Kitt
    Commented Jul 25, 2019 at 7:16
  • My images is FROM nginx:1.17, I am considering upgrade the images or basic on the image I have to upgrade passwd and login package.
    – SmileSees
    Commented Jul 25, 2019 at 8:25

1 Answer 1

Reset to default
2

From the package version numbers, it looks like Debian 9 ("stretch"), which is the oldstable version since 2019-07-06. Maybe it's time to consider updating your Docker image to use a newer stable version?

CVE-2017-12424 appears to be about the /usr/sbin/newusers tool, which is in the passwd package. If you don't need that specific tool in your Docker image, maybe use a .dockerignore file to omit it entirely, as a workaround?

shadow is the source code package that builds multiple utilities: Debian packages the utilities into three separate packages. In this case, the vulnerable utility is in the passwd package, which would need to be upgraded; however, Debian 9 does not currently seem to have a newer version of the package available. Only Debian 10 ("buster", the new stable version) and above has the fixed version available.

Moving up to a passwd package from Debian 10 without upgrading the rest of the image to match is likely to cause library dependency errors. Upgrading your entire base image from Debian 9 to Debian 10 might be a good investment of your time at this point.

But if you want a fixed version of the passwd package that is compatible with other Debian 9 packages right now, you might have to download the Debian source package for shadow 4.5-1.1 to a Debian 9 system with the compiler and other build tools installed, and run a dpkg-buildpackage on the sources to get a newer version of the passwd package that is compiled against the libraries of Debian 9. Injecting this custom package into your Docker image build process would be your task.

(As a side effect of the build, you will also get newer versions of packages login and uidmap: however, as long as the standard Debian 9 versions of those packages don't have any known vulnerable contents, you'll have the option of ignoring them.)

Note that CVE-2017-12424 applies only if you have a system in place that allows unprivileged users to run the newusers command in a privileged context, e.g. a Control Panel in a web-hosting environment or an /etc/sudoers entry that allows a non-root user to run newusers as root. This is probably the reason why the fixed version has not been propagated to Debian 9 yet: the security team did not consider it a high-priority issue.

Improve this answer
3
  • Since I cannot directly upgrade shadow with apt-get command, do I need to upgrade passwd instead?
    – SmileSees
    Commented Jul 25, 2019 at 8:28
  • Answer updated with a more detailed explanation.
    – telcoM
    Commented Jul 25, 2019 at 9:31
  • Thanks @telcoM, I have upgrade my offical nginx images to 1.17.2, it is using Debian 10, and I also upgrade my passwd package to 1:4.7-2 by changed the /etc/apt/source.list to bullseye.
    – SmileSees
    Commented Jul 26, 2019 at 3:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .