# Docker image vulnerabilies **URL:** \ **Category:** Elasticsearch\ **Tags:** docker\ **Created:** [June 5, 2019, 11:38pm UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472 "2019-06-05T23:38:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Yohan\_al](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yohan_al/32/47589_2.png) [@Yohan\_al](https://discuss.elastic.co/u/Yohan_al)\ **Post date:** [June 5, 2019, 11:38pm UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/1 "2019-06-05T23:38:22Z")
Hi, We've seen on docker hub somes criticals vulnerabilities on the latest elasticsearch docker image. [CVE-2014-6277](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277) [CVE-2014-6278](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278) [CVE-2019-9924](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9924) [CVE-2018-15686](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15686) [CVE-2018-14618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14618) [CVE-2019-8457](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457) [CVE-2019-9169](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169) ... how can we know when thoses vulnerabilies will be tackled ? is it planned ? Thank you in advance, Yohan ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 6, 2019, 12:57am UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/2 "2019-06-06T00:57:09Z")
Hey. The official images are not in DockerHub. Have a look at [https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html) HTH ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [June 6, 2019, 1:15am UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/3 "2019-06-06T01:15:22Z")
Hi @Yohan_al, I wouldn't expect any of these to affect our latest container images, but I would also like to better understand what's happening here. Can you let me know what the container names are and what scanner is giving these results? If you're not comfortable posting what the image names are, please mail [security@elastic.co](mailto:security@elastic.co) and we can followup there. Josh Bressers Elastic Product Security ---
**Author:** ![Yohan\_al](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yohan_al/32/47589_2.png) [@Yohan\_al](https://discuss.elastic.co/u/Yohan_al)\ **Post date:** [June 6, 2019, 4:49am UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/4 "2019-06-06T04:49:09Z")
Hello guys, thank you for your quick feedback . As David says, we was using image based on docker hub (10 millions download). Is there really a difference ? it seems that image Id are the same between the two repositories (docker hub and elastic repository). if you re loggin on docker hub, you saw on tags page potentials vulnerabilities : here : [https://hub.docker.com/\_/elasticsearch?tab=tags](https://hub.docker.com/_/elasticsearch?tab=tags) screenshot : [https://ibb.co/6HPVg9D](https://ibb.co/6HPVg9D) I don't know wich scanner is used on docker hub, may be you will find what you re looking for in their documentation. > **[Docker Security Scanning](https://docs.docker.com/v17.12/docker-cloud/builds/image-scan/#the-docker-security-scan-process)** > > The Docker Security Scanning preview service will end on March 31st, 2018, for private repos (not official repos) in both Docker Cloud and Docker Hub. Until then, scanning in private... ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [June 6, 2019, 5:11am UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/5 "2019-06-06T05:11:30Z")
> [@dadoonet](#): > > The official images are not in DockerHub. I'm sorry. That was wrong. Images in Docker hub are like mirrors to our Docker repository. ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [June 6, 2019, 6:22pm UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/6 "2019-06-06T18:22:17Z")
Hi @Yohan_al, I took a look at this list (I didn't know this was a thing even, so thanks for that). Everything on that list is a false positive. I'll go over them below. [https://hub.docker.com/\_/elasticsearch/scans/library/elasticsearch/7.1.1](https://hub.docker.com/_/elasticsearch/scans/library/elasticsearch/7.1.1) - expat 1.95.7 - We don't use this library or any of it's functionality in any way. It's part of apr (and we don't use features that touch expat there either). - lucene - This looks like a problem with the scanner. The flaw in question is for Solr only - jackson-databind 2.8.11.3 - This is known. We don't use jackson-databind in a vulnerable manner and are planning to upgrade in a future release. As we're not vulnerable to the flaws the upgrade is not a high priority. - guava - This is known. We don't use guava in a vulnerable manner and are planning to upgrade in a future release. As we're not vulnerable to the flaws the upgrade is not a high priority. - apr - We do not use the functions in question Let me know if you need anything else. Thanks ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2019, 6:22pm UTC](https://discuss.elastic.co/t/docker-image-vulnerabilies/184472/7 "2019-07-04T18:22:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.