Release 0.10.0 of cheatset, Docker edition
Tags: opensource, release, docker, cheatset
Published: 2022-02-23 19:45:55

---
title: Release 0.10.0 of cheatset, Docker edition
published: true
description: an update version, with Ruby base image update (3.1.1)
tags: opensource, release, docker, cheatset
//cover_image: https://direct_url_to_image.jpg
---
I received a PR from Dependabot, proposing an update of the **Ruby** base image.

When I [announced release 0.8.0](https://dev.to/jonasbn/release-080-of-cheatset-docker-edition-2oc4) I included a lot of information on the **Snyk** vulnerability scan of the Docker image. I skipped this for [release 0.9.0 announcement](https://dev.to/jonasbn/release-090-of-cheatset-docker-edition-m1a), _which I regret now_.

So to recap, it looked as follows for [0.8.0](https://github.com/jonasbn/docker-cheatset/releases/tag/0.8.0), **not** the _slim_ version, by severity:

- 11 critical
- 18 high
- 35 medium
- 132 low

For the _slim_ version used for release [0.9.0](https://github.com/jonasbn/docker-cheatset/releases/tag/0.9.0), by severity (_restored based on an email report from **Snyk**_):

- 2 critical
- 2 high
- 1 medium
- 26 low

I hoped that the update of the new Ruby [base image](https://snyk.io/advisor/docker/ruby/3.1.1-bullseye) would improve the situation and it did, but I am not sure I completely understand what happened.

The report for base image score as follows, by severity:

- 0 critical
- 0 high
- 0 medium
- 44 low

The Ruby base image is primarily _rooted_ in the **Debian** Bullseye _slim_ base image, the [report](https://snyk.io/test/docker/debian%3Abullseye-slim) from **Snyk** is public available and demonstrates this, with the 44 vulnerabilities scored as low.

If you check one of the vulnerabilities in the **Snyk** report (you can click the vulnerabilities, you can get additional details, example: ["Buffer Overflow"](https://security.snyk.io/vuln/SNYK-DEBIAN11-GLIBC-2340908) in glibc).

You can see that it was introduced: 14th. January 2022 (the day before my birthday actually) and it has the Common Vulnerabilities and Exposures (CVE) key: `CVE-2022-23219`. It also holds following note from **Snyk**:

> Although NVD CVSS Score is: 9.8 (Critical), when available we recommend using the distro's own rating score.

Which indicate that the **Debian** maintainers have scored the vulnerability as low and **Snyk** echoes this.

If you check the [CVE with Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23219) and [nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2022-23219) you can see that it has the score of `9.8 Critical`, which also ties back to the information on the **Snyk** site, so **Snyk** is just relaying the information.

If we check the [Debian release](https://security-tracker.debian.org/tracker/CVE-2022-23219), we can see that it is marked as a `minor issue`.

We can see that **Debian** Bullseye (stable) uses the version: `2.31-13+deb11u2` of [glibc](https://www.gnu.org/software/libc/). It is marked as fixed in Debian Bookworm and Debian Sid, which are upstream to the Debian _stable_ distribution. But it is not fixed in glibc until version: [2.35](https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html).

Security reports are surely a rabbit hole and if somebody can enlighten me on how to navigate this and interpreting and understanding the differences in scores, it would be most welcome, for now I am just monitoring and learning and trying to get the most out of the tools available.

I will keep an eye on the development in these security issues, I am looking very much for to the next Debian point release for Bullseye, which should be out every second month and last release was in December, perhaps this addresses some of the known issues, but lets see.

If you run into any issues with the 0.10.0 release, please report this via [GitHub](https://github.com/jonasbn/docker-cheatset).

## Change log

This is the [change log lifted from GitHub](https://github.com/jonasbn/docker-cheatset/releases/tag/0.10.0)

## 0.10.0 2022-02-21 Maintenance release

- Bumped from Ruby 3.1.0-slim-bullseye to 3.1.1-slim-bullseye, via PR [#32](https://github.com/jonasbn/docker-cheatset/pull/32) from @dependabot