cimg/node:14.17.4 policykit vulnerability CVE-2021-4034

[circleci-public]

cimg/node:14.17.4 policykit vulnerability CVE-2021-4034

[felicianotech]

I'd like to add, sudo apt-get update and sudo apt-get -y upgrade can be run in the image to update the policykit package to one with a fix. Or instead of "upgrade", an install of a specific package will just update that one, saving some time.

Most importantly though, this CVE doesn't really affect a CI build unless you are incorporating one of Ubuntu's packages into your own code. The privilege escalation is not a danger because we allow password sudo access in the first place in the image. The image already allows easier access to root then the CVE would.

[JalexChen]

Hi @hamisor,

Thanks for letting us know - if you were interested in making these changes on your end in the meantime, you could run ./shared/gen-dockerfiles.sh 14.17.4 in your shell and it will generate a new Dockerfile that uses our latest base image, which points to cimg/base:2022.01.

However, since we want these images to be deterministic at the time they were created, we won't be updating the images fof 14.17.4 on our end

[hamisor]

thanks for the clarification @felicianotech. We are only using this node image for the circle ci build not as the base of our application, so it is not a priority to update the base image at all. Just wondering how often this node image gets updated with the base image?