Answers: <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-5363" rel="nofollow noreferrer">CVS-2023-5363</a> and <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-5678" rel="nofollow noreferrer">CVE-2023-5678</a> are both vulnerabilities in OpenSSL. They don't come from any of the code that you wrote. Your base image - <code>node:21-alpine</code> - probably has a vulnerable version of OpenSSL by default. By adding the commands to update installed packages, you are installing a patched version of OpenSSL that no longer contains the vulnerabilities.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-11-29T13:03:23.457Z
Answers: 2023-11-29T13:03:23.457Z
Answers: Thomas Owens
Answers: <p>I added this line to my <code>make.dockerfile</code></p>
  <pre><code>RUN apk update &amp;&amp; \
      apk upgrade &amp;&amp; \
      apk add --no-cache openssl
  
  </code></pre>
  <p>So now my code looks like:</p>
  <pre><code>FROM node:21-alpine
  
  WORKDIR /api
  RUN apk update &amp;&amp; \
      apk upgrade &amp;&amp; \
      apk add --no-cache openssl
  
  COPY ./package*.json ./
  
  RUN mkdir ./src
  COPY ./src/ ./src/
  
  RUN npm install
  ENTRYPOINT [ &quot;echo&quot;, &quot;'All Done'&quot; ]
  
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2023-11-29T02:09:09.243Z
Answers: 2023-11-29T02:09:09.243Z
Answers: learningtech
Body: <p>Dockerhub says I have the vulnerabilities: CVE-2023-5363 and CVE-2023-5678, which is part of the openssl package.
  See this image:
  <a href="https://i.sstatic.net/1QQhu.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/1QQhu.png" alt="enter image description here" /></a></p>
  <p>Does anyone know how I can resolve this issue?  I've simplified my nodejs project to just <code>console.log('hello world');</code> and I removed all possible npm packages, but I still get this vulnerability.  My <code>hello</code> project only consists of 4 files and they are:</p>
  <p><code>~/src/index.js</code></p>
  <pre><code>console.log('hello');
  </code></pre>
  <p><code>~/package.json</code></p>
  <pre><code>{
    &quot;name&quot;: &quot;test&quot;,
    &quot;version&quot;: &quot;1.0.0&quot;,
    &quot;main&quot;: &quot;src/index.js&quot;,
    &quot;scripts&quot;: {},
    &quot;dependencies&quot;: {},
    &quot;devDependencies&quot;: {}
  }
  </code></pre>
  <p><code>~/docker-compose.yml</code></p>
  <pre><code>version: &quot;3.8&quot;
  services:
    api_image:
      image: johndev/api:test2
      build:
        context: ./
        dockerfile: ./make.dockerfile
  </code></pre>
  <p><code>~/make.dockerfile</code></p>
  <pre><code>FROM node:21-alpine
  
  WORKDIR /api
  
  COPY ./package*.json ./
  
  RUN mkdir ./src
  COPY ./src/ ./src/
  
  RUN npm install
  ENTRYPOINT [ &quot;echo&quot;, &quot;'All Done'&quot; ]
  </code></pre>
  <p>To push an image to dockerhub, I just run these commands:</p>
  <pre><code>docker-compose up --build -d;
  docker push johndev/api:test2;
  </code></pre>
  <p>What did I do wrong?  What in my code is causing the vulnerabilities CVE-2023-5363 and CVE-2023-5678?</p>
  
Tags: <docker-compose><node.js><dockerhub><npm>
Title: Dockerhub says Hello World causes CVE-2023-5363 and CVE-2023-5678
UserDisplayName: learningtech
ThreadText: # Dockerhub says Hello World causes CVE-2023-5363 and CVE-2023-5678
  
  (Asked by: username_0 on 2023-11-29)
  
  Dockerhub says I have the vulnerabilities: CVE-2023-5363 and CVE-2023-5678, which is part of the openssl package.
  See this image:
  [![enter image description here](https://i.sstatic.net/1QQhu.png)](https://i.sstatic.net/1QQhu.png)
  
  Does anyone know how I can resolve this issue? I've simplified my nodejs project to just `console.log('hello world');` and I removed all possible npm packages, but I still get this vulnerability. My `hello` project only consists of 4 files and they are:
  
  `~/src/index.js`
  
  ```
  console.log('hello');
  
  ```
  
  `~/package.json`
  
  ```
  {
    "name": "test",
    "version": "1.0.0",
    "main": "src/index.js",
    "scripts": {},
    "dependencies": {},
    "devDependencies": {}
  }
  
  ```
  
  `~/docker-compose.yml`
  
  ```
  version: "3.8"
  services:
    api_image:
      image: johndev/api:test2
      build:
        context: ./
        dockerfile: ./make.dockerfile
  
  ```
  
  `~/make.dockerfile`
  
  ```
  FROM node:21-alpine
  
  WORKDIR /api
  
  COPY ./package*.json ./
  
  RUN mkdir ./src
  COPY ./src/ ./src/
  
  RUN npm install
  ENTRYPOINT [ "echo", "'All Done'" ]
  
  ```
  
  To push an image to dockerhub, I just run these commands:
  
  ```
  docker-compose up --build -d;
  docker push johndev/api:test2;
  
  ```
  
  What did I do wrong? What in my code is causing the vulnerabilities CVE-2023-5363 and CVE-2023-5678?
  
  **Tags:** docker-compose, node.js, dockerhub, npm
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2023-11-29. Score: 1
  
  [CVS-2023-5363](https://nvd.nist.gov/vuln/detail/CVE-2023-5363) and [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) are both vulnerabilities in OpenSSL. They don't come from any of the code that you wrote. Your base image - `node:21-alpine` - probably has a vulnerable version of OpenSSL by default. By adding the commands to update installed packages, you are installing a patched version of OpenSSL that no longer contains the vulnerabilities.
  
  
  ---
  
  ### Answer by username_0 on 2023-11-29. Score: 0
  
  I added this line to my `make.dockerfile`
  
  ```
  RUN apk update && \
      apk upgrade && \
      apk add --no-cache openssl
  
  ```
  
  So now my code looks like:
  
  ```
  FROM node:21-alpine
  
  WORKDIR /api
  RUN apk update && \
      apk upgrade && \
      apk add --no-cache openssl
  
  COPY ./package*.json ./
  
  RUN mkdir ./src
  COPY ./src/ ./src/
  
  RUN npm install
  ENTRYPOINT [ "echo", "'All Done'" ]
  
  ```
  
  
  ---
  
  