# Observability/apm-lambda-extension docker image causing vulnerabilities **URL:** \ **Category:** APM\ **Tags:** docker, nodejs, aws-lambda\ **Created:** [January 9, 2024, 9:41pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685 "2024-01-09T21:41:03Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![SELENAAA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selenaaa/32/115995_2.png) [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Post date:** [January 9, 2024, 9:41pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/1 "2024-01-09T21:41:03Z")
I'm following this [guide](https://www.elastic.co/guide/en/apm/agent/nodejs/4.x/lambda.html) to add a nodejs apm agent to my container image based function; however, the observability/apm-lambda-extension is causing some scan image vulnerabilities with the package go. I'm searching for the list of versions for observability/apm-lambda-extension but cannot find anything in [https://www.docker.elastic.co/](https://www.docker.elastic.co/). Could someone please help? Thanks ---
**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\ **Post date:** [January 10, 2024, 1:14am UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/2 "2024-01-10T01:14:18Z")
@SELENAAA The list of releases of the Elastic APM Lambda Extension is here: [Releases · elastic/apm-aws-lambda · GitHub](https://github.com/elastic/apm-aws-lambda/releases) I'm sure I am missing it, but I don't immediately see what part of the docs led you to using the published Docker images for the extension rather than the Lambda layer published to AWS. Here is one of the pages on [www.docker.elastic.co](http://www.docker.elastic.co) for the Lambda extension: [observability/apm-lambda-extension-x86\_64 | Docker @ Elastic](https://www.docker.elastic.co/r/observability/apm-lambda-extension-x86_64) There is one for each architecture. ... and I believe one just needs to know that URL, because it doesn't show up in search results on that site, unfortunately. ---
**Author:** ![SELENAAA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selenaaa/32/115995_2.png) [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Post date:** [January 10, 2024, 8:37pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/3 "2024-01-10T20:37:34Z")
Hi, I tried the different versions of the apm lambda extension image, still seeing the scan image vulnerabilities with package go, I see [CVE-2023-39325](https://scout.docker.com/vulnerabilities/id/CVE-2023-39325) when pulling the image, could you please take a look? Thanks ---
**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\ **Post date:** [January 10, 2024, 9:07pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/4 "2024-01-10T21:07:56Z")
@SELENAAA Can you show what tool or command is doing that scan? What is it that is showing the vulnerability? What image version is it checking? etc. More details would help us start looking. ---
**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\ **Post date:** [January 10, 2024, 9:15pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/5 "2024-01-10T21:15:40Z")
Okay, I believe I see what you mean: ```auto % docker scout cves docker.elastic.co/observability/apm-lambda-extension-x86_64:latest ... 0C 1H 2M 0L stdlib 1.21.1 pkg:golang/stdlib@1.21.1 ✗ HIGH CVE-2023-39325 https://scout.docker.com/v/CVE-2023-39325 Affected range : >=1.21.0-0 : <1.21.3 Fixed version : 1.21.3 ... ``` ---
**Author:** ![SELENAAA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selenaaa/32/115995_2.png) [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Post date:** [January 10, 2024, 9:20pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/6 "2024-01-10T21:20:22Z")
yeah I'm using the latest version of apm lambda extension and the vulnerabilities that I'm seeing are the following: CVE-2023-39323 | 9.80 | critical | Binary | go | 1.21.1 | fixed in 1.21.2, 1.20.9 | 13 Oct 23 20:00 UTC | [NVD - CVE-2023-39323](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39323) | CVE-2023-39325 | 7.50 | high | Binary | go | 1.21.1 | fixed in 1.21.3, 1.20.10 | 31 Oct 23 22:06 UTC | [NVD - CVE-2023-39325](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39325) | CVE-2023-45283 | 7.50 | high | Binary | go | 1.21.1 | fixed in 1.21.4, 1.20.11 | 15 Dec 23 11:55 UTC | [NVD - CVE-2023-45283](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45283) | CVE-2023-45285 | 7.50 | high | Binary | go | 1.21.1 | fixed in 1.21.5, 1.20.12 | 12 Dec 23 19:40 UTC | [NVD - CVE-2023-45285](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45285) | ---
**Author:** ![trentm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trentm/32/77647_2.png) [@trentm](https://discuss.elastic.co/u/trentm)\ **Post date:** [January 11, 2024, 5:58pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/7 "2024-01-11T17:58:21Z")
@SELENAAA Thanks. We have an update here: [build: bump docker image deps by trentm · Pull Request #431 · elastic/apm-aws-lambda · GitHub](https://github.com/elastic/apm-aws-lambda/pull/431) and will have a new 1.5.2 release out soon that should clear up the docker scout warnings. ---
**Author:** ![SELENAAA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selenaaa/32/115995_2.png) [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Post date:** [January 11, 2024, 6:27pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/8 "2024-01-11T18:27:16Z")
Awesome, thank you so much for your help! ---
**Author:** ![SELENAAA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/selenaaa/32/115995_2.png) [@SELENAAA](https://discuss.elastic.co/u/SELENAAA)\ **Post date:** [January 11, 2024, 9:31pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/9 "2024-01-11T21:31:34Z")
Just to provide a quick update, I tested the version 1.5.2, no longer seeing the docker vulnerabilities, again thanks for the help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2024, 9:31pm UTC](https://discuss.elastic.co/t/observability-apm-lambda-extension-docker-image-causing-vulnerabilities/350685/10 "2024-02-08T21:31:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.