# 76 critical 125 major and 6 minor vulnerabilities **URL:** \ **Category:** Community Support\ **Created:** [December 6, 2018, 2:10pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636 "2018-12-06T14:10:19Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 6, 2018, 2:10pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/1 "2018-12-06T14:10:19Z")
Rocket.Chat 0.72.0 has 76 critical 125 major and 6 minor vulnerabilities when scanned by Docker DTR. By running the code below in my Docker file it reduces to 37 Critical 56 Major 5 Minor 1 Hidden && npm i npa@latest -g && npm update -g There are the 37 Critical one I have left but I cannot figure out how to fix these. I have tried updating them but nothing works. Does anyone have ideas or have figure a way to fix these vulnerabilities? pcre 8.31 17 Critical4 Major libpng 1.6.12 5 Critical1 Major libpng 1.5.10 4 Critical5 Major sqlite3 3.7.7.1 4 Critical1 Major zlib 1.2.5 2 Critical2 Major kerberos 1.12.1+dfsg-19+deb8u4 1 Critical3 Major libicu 52.1-8+deb8u7 1 Critical1 Major glibc 2.19-18+deb8u10 1 Critical cryptsetup 1.6.6-5 1 Critical kerberos 1 Critical I am using this Dockerfile as my base. > ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 8, 2018, 2:44am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/2 "2018-12-08T02:44:37Z")
Seems most of these are in the Debian base. I wrestled with this actually for several days before I swapped Debian out for alpine. > May be of interest? ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 11, 2018, 9:22pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/4 "2018-12-11T21:22:33Z")
Wow this thing is huge! 1.13GB rocketchat/rocket.chat:0.71.1-1 ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 12, 2018, 3:56am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/5 "2018-12-12T03:56:34Z")
My local stats for sure did not read 1.3 Gig. Sadly this is the downside to nodejs and npm. By time you do npm install things definitely grow. But our scans through Claire returned no issues. I’m guessing the big part is since using musl instead of the usual libc variants ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 13, 2018, 4:11pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/6 "2018-12-13T16:11:49Z")
There it is haha rocketchat/rocket.chat 0.71.1-1 481dc2c89675 5 weeks ago 1.13GB I am going to run it through my corps Aqua scanning. Ill let you know if we find any vulnerabilities. ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 14, 2018, 9:08pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/7 "2018-12-14T21:08:48Z")
Sounds good! Please let me know how it goes 👍 ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 17, 2018, 5:39pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/8 "2018-12-17T17:39:59Z")
Well we scan with Aqua: I will post what they are when I look at them today. - 56 High - 93 Medium - 44 Low - 0 Negligible ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 17, 2018, 5:49pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/9 "2018-12-17T17:49:38Z")
These are only the high ones Scan Report: rocket.chat:0.72.1-1 Name Resource Severity Score Fix Version WS-2018-0111 /app/bundle/programs/server/npm/node\_modules/base64-url/index.js high 8.6 2.0.0 WS-2018-0084 sshpk high 7 None WS-2016-0035 tough-cookie high 7 2.3.0 WS-2015-0024 uglify-js high 7 2.4.24. WS-2015-0024 uglify-js high 7 2.4.24. WS-2018-0084 sshpk high 7 None WS-2016-0035 tough-cookie high 7 2.3.0 WS-2015-0024 uglify-js high 7 2.4.24. WS-2018-0084 /app/bundle/programs/server/npm/node\_modules/meteor/http/node\_modules/sshpk/lib/formats/ssh.js high 8 None WS-2017-0314 fresh high 7 None CVE-2017-16119 fresh high 7 None WS-2016-0037 negotiator high 7 0.6.1 WS-2016-0017 negotiator high 7 0.6.1 WS-2017-0330 mime high 7 None CVE-2017-16138 mime high 7 None WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_accounts/node\_modules/moment/min/moment.min.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_accounts/node\_modules/moment/min/moment-with-locales.min.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_accounts/node\_modules/moment/moment.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_accounts/node\_modules/moment/min/moment-with-locales.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_accounts/node\_modules/moment/src/lib/parse/regex.js high 7.5 2.19.3 CVE-2017-16118 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_grant/node\_modules/forwarded/index.js high 7.5 None WS-2017-0313 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_grant/node\_modules/forwarded/index.js high 7.5 None WS-2018-0084 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_grant/node\_modules/sshpk/lib/formats/ssh.js high 8 None WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_graphql/node\_modules/moment/min/moment-with-locales.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_graphql/node\_modules/moment/min/moment-with-locales.min.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_graphql/node\_modules/moment/min/moment.min.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_graphql/node\_modules/moment/moment.js high 7.5 2.19.3 WS-2017-0422 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_graphql/node\_modules/moment/src/lib/parse/regex.js high 7.5 2.19.3 WS-2018-0111 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_internal-hubot/node\_modules/base64-url/index.js high 8.6 2.0.0 WS-2016-0017 /app/bundle/programs/server/npm/node\_modules/meteor/rocketchat\_internal-hubot/node\_modules/negotiator/lib/language.js high 7.5 0.6.1 WS-2017-0255 pidusage high 7 None WS-2018-0084 sshpk high 7 None WS-2016-0037 negotiator high 7 0.6.1 WS-2016-0017 negotiator high 7 0.6.1 WS-2017-0314 fresh high 7 None CVE-2017-16119 fresh high 7 None WS-2017-0313 forwarded high 7 None CVE-2017-16118 forwarded high 7 None WS-2017-0330 mime high 7 None CVE-2017-16138 mime high 7 None WS-2016-0037 negotiator high 7 0.6.1 WS-2016-0017 negotiator high 7 0.6.1 WS-2018-0111 base64-url high 7 2.0.0 WS-2016-0037 negotiator high 7 0.6.1 WS-2016-0017 negotiator high 7 0.6.1 WS-2018-0111 base64-url high 7 2.0.0 WS-2017-0314 fresh high 7 None CVE-2017-16119 fresh high 7 None WS-2017-0328 method-override high 7 None WS-2016-0037 negotiator high 7 0.6.1 WS-2016-0017 negotiator high 7 0.6.1 WS-2017-0330 mime high 7 None CVE-2017-16138 mime high 7 None WS-2016-0017 /app/bundle/programs/server/npm/node\_modules/negotiator/lib/language.js high 7.5 0.6.1 CVE-2018-3774 /app/bundle/programs/server/npm/node\_modules/url-parse/index.js high 8 None CVE-2018-12699 binutils high 7.5 None ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 17, 2018, 5:58pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/10 "2018-12-17T17:58:08Z")
Well I guess good news is alpine seems to have removed most of the container level issues. But a lot of things in the npm packages. @rodrigo.nascimento @diego.sampaio 🔝 just so on your radar. ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 18, 2018, 12:12am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/11 "2018-12-18T00:12:39Z")
Would I include this inside your file if I wanted to update base64url and sshpk and the rest of the vulnerabilities? Look at the end of the file…this is just an example. ``` FROM node:8.12-alpine RUN apk add python make g++ libc6-compat ttf-dejavu ADD . /app RUN set -x \ && cd /app/bundle/programs/server \ && npm install \ && npm cache clear --force \ && npm update base64url@2.2.0 \ && npm update sshpk@1.15.2 \ ``` ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 18, 2018, 6:33am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/12 "2018-12-18T06:33:25Z")
Technically yes… but doing so could have unintended side effects ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [December 20, 2018, 5:42pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/13 "2018-12-20T17:42:04Z")
How could we fix those vulnerabilities? So the image has none when scanned by Aqua? ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [December 21, 2018, 6:25am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/14 "2018-12-21T06:25:49Z")
Clone source, update the dependencies that have the vulnerabilities. Test that nothing breaks… then open a PR and get those changes merged. Of course before hand building bundle and image and running through aqua. ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [January 15, 2019, 2:37pm UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/15 "2019-01-15T14:37:19Z")
Recent update! Here is the dockerfile we created that now has: - 12 High - 74 Medium - 12 Low - 74 Negligible These are the Highs WS-2015-0012 WS-2017-0422 CVE-2017-16111 WS-2017-0306 CVE-2016-2515 WS-2018-0085 WS-2018-0084 ---
**Author:** ![fsejoseph](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@fsejoseph](https://forums.rocket.chat/u/fsejoseph)\ **Post date:** [January 16, 2019, 1:06am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/16 "2019-01-16T01:06:25Z")
The problem we are having with the image i posted is that the CMD cannot find the main.js. What would we change the CMD line to so RC will work? The image builds but not the container / service when you use the image. I know the WORKDIR has to change because when you unzip the tar file the files change. BUT I have not found a main.js that would work. What other file should we use to get RC up and running in the CMD section? Error we get > module.js:549 > > throw err; > > ^ > > Error: Cannot find module ‘/app/bundle/main.js’ > > at Function.Module.\_resolveFilename (module.js:547:15) > > at Function.Module.\_load (module.js:474:25) > > at Function.Module.runMain (module.js:693:10) > > at startup (bootstrap\_node.js:191:16) > > at bootstrap\_node.js:612:3 ---
**Author:** ![aaron.ogle](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/aaron.ogle/32/15_2.png) [@aaron.ogle](https://forums.rocket.chat/u/aaron.ogle)\ **Post date:** [January 20, 2019, 4:21am UTC](https://forums.rocket.chat/t/76-critical-125-major-and-6-minor-vulnerabilities/2636/17 "2019-01-20T04:21:01Z")
Can you post your updated dockerfile? Might be able to help you track down the issue