Best to get insecure and vulnerable software out of the hands of those who may not be familiar with this CVE or their change in policy that has not gotten a press release in any way.
> I felt it might be appropriate for me to reach out as one of the stewards of the Docker Official Images program.The minio image is basically a community one that anyone could have created, but still shows in overall docker hub. It's created by minio themselves. I'm kind of surprised they haven't removed it, but with over a billion downloads they are easily in the top ten of whatever category they fall under creating substantial free advertisement.
Given the developers have not replied to the thread after a day and the one who was enthusiastic is now the one doling out the information that they are no longer supporting their docker image, I highly doubt they will perform a 180 on policy and suddenly work with them to provide an official curated image. If they wanted to keep the docker image alive they would have continued updating it and not shut down community feedback begging for them to maintain it.
Docker has a vested interest in keeping popular images maintained and a billion+ download package suddenly becoming defunct is noticable to them. Minio seems to be prioritizing their commercial offering and removing support for their open source offering though. Nuking their community documentation doesn't spell anything good for the future of minio for the FOSS community.
Why is that the best? MinIO is not the type of thing that people ought to be directly making available on the Internet anyway, so CVEs are mostly irrelevant unless you are an organization that has to keep on top of them, in which case you certainly have a process in place to do so already.
People straight pulling an image off Dockerhub (so not a particularly sophisticated use-case) to run seem like they'd be the least likely to be impacted by a CVE like this. The impact is apparently "[it] allows the attacker to access buckets and objects beyond their intended restrictions and modify, delete, or create objects outside their authorized scope". Are people pulling from Dockerhub even setting up anything but the absolute most basic (Allow All) ACL?
The cargo-culting around security is so bizarre to me. In a context where e.g. your organization needs to pass audits, it's cheaper/easier to just update stuff and not attempt to analyze everything so you can check the box. For everyone else, most security advisories are just noise that usually aren't relevant to the actual way software is used. Notably, no one in these discussions is even bringing up what the vulnerability is.
That's because of two things. The first is, assessment takes a deep dive into the issue, not a summary. Conjoined with the second, in that you must be ready to update if required, without issue.
In every case, it's less time cost even for home lab users to update instead of assess.
If it isn't, you're using terrible software, for example software which pushes security updates along with API and code changes. Such software doesn't take user security seriously, and should be avoided at all costs.
There's no way around it. Just do it right, don't half ass with excuses. Don't use terrible software. If it's plugged into a network, zero trust it is.
"Hello,
This does not qualify as an infringement to our Terms of Use policy. Deprecating such images and repo(s) is the responsibility of the owner and we recommend you reach out to them. Docker advises its users to opt into using images under our official programs and offerings such as Docker Official Images and Docker Hardened Images.
Thank you, Security@Docker"
In their ToU under section 6.6, they outline how they may scan images for vulnerabilities and request the owners of said packages fix it, or simply remove it from their site. They clearly do not do this though even when notified of the high criticality vulnerability.
I think the most they'd do is add the DEPRECATED note to the Docker hub page as they have done for things like Centos
Actually, Docker did something like that, where they limited the amount of docker images they would host for you for free to a reasonable number. The result was pretty similar to this current outcry: https://news.ycombinator.com/item?id=24143588
Setting up a registry and a pipeline is annoying but it's hardly a life changing event. It's certainly easier than migrating to a competitor.