0.8.0 flagged with CVE-2023-24538 #805
Comments
|
Hi @perry-mitchell, these are CVEs with Go. pgvector isn't written in Go, and the Docker image doesn't have it installed. |
|
The Docker entrypoint does use |
|
That is the base image provided by Docker. You'll need to work with the maintainers there to address this. |
|
It's a CVE in pgvector's dependency chain, so I think the issue is relevant, regardless of whether or not it can be patched immediately. It seems as though postgres would need to address this as well, but that doesn't remove the fact that the current latest build of this application is flagged with the vulnerability, and that's being picked up in scanners. For instance, Full output hereThe current postgres discussion (one of) tracking this issue: docker-library/postgres#1304 |
|
For anyone hitting the same issue, I got around this by simply dropping Imo there'd be better ways to do the same thing besides using a custom tool like gosu but that's a postgres decision not bound to this repository. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello!
I've been releasing the latest tag on Snowflake (SPCS) and have recently seen that pgvector has been flagged as having CVE-2023-24538.
Seems to be a super old CVE too. Any chance an update might be planned with updated dependencies? I've sent an email to the listed address on the Security tab too. Felt it was acceptable to share in an issue as they're so old.
EDIT: After scanning the image further, these vulnerabilities are present:
The text was updated successfully, but these errors were encountered: