CVE-2021-46848

[bitnami]

CVE-2021-46848

[carrodher]

The bitnami/minideb image is based on the official Debian container. The reported CVE is part of the underlying distro (Debian 11) in this case. See the vulnerability report when running the official debian container image:

$ trivy image debian:bullseye | grep CVE-2021-46848
2022-11-03T15:45:42.064Z	INFO	Vulnerability scanning is enabled
2022-11-03T15:45:42.064Z	INFO	Secret scanning is enabled
2022-11-03T15:45:42.064Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-03T15:45:42.064Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.32/docs/secret/scanning/#recommendation for faster secret detection
2022-11-03T15:45:45.540Z	INFO	Detected OS: debian
2022-11-03T15:45:45.540Z	INFO	Detecting Debian vulnerabilities...
2022-11-03T15:45:45.550Z	INFO	Number of language-specific files: 0
│ libtasn1-6       │ CVE-2021-46848   │ CRITICAL │ 4.16.0-2          │               │ GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array  │

$ trivy image debian:bullseye-slim | grep CVE-2021-46848
2022-11-03T15:47:01.651Z	INFO	Vulnerability scanning is enabled
2022-11-03T15:47:01.652Z	INFO	Secret scanning is enabled
2022-11-03T15:47:01.652Z	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-03T15:47:01.652Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.32/docs/secret/scanning/#recommendation for faster secret detection
2022-11-03T15:47:04.788Z	INFO	Detected OS: debian
2022-11-03T15:47:04.788Z	INFO	Detecting Debian vulnerabilities...
2022-11-03T15:47:04.798Z	INFO	Number of language-specific files: 0
│ libtasn1-6       │ CVE-2021-46848   │ CRITICAL │ 4.16.0-2          │               │ GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array  │

I'm not sure where is the proper place to ask for support in the Debian project, but that should be the proper place to report this issue