{"action":"closed","issue":{"url":"https://api.github.com/repos/CentOS/sig-cloud-instance-images/issues/126","repository_url":"https://api.github.com/repos/CentOS/sig-cloud-instance-images","labels_url":"https://api.github.com/repos/CentOS/sig-cloud-instance-images/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/CentOS/sig-cloud-instance-images/issues/126/comments","events_url":"https://api.github.com/repos/CentOS/sig-cloud-instance-images/issues/126/events","html_url":"https://github.com/CentOS/sig-cloud-instance-images/issues/126","id":372971299,"node_id":"MDU6SXNzdWUzNzI5NzEyOTk=","number":126,"title":"vim-minimal package in cent os 7 docker image is very old and is potentially unsafe ","user":{"login":"yaduvesh","id":44401547,"node_id":"MDQ6VXNlcjQ0NDAxNTQ3","avatar_url":"https://avatars0.githubusercontent.com/u/44401547?v=4","gravatar_id":"","url":"https://api.github.com/users/yaduvesh","html_url":"https://github.com/yaduvesh","followers_url":"https://api.github.com/users/yaduvesh/followers","following_url":"https://api.github.com/users/yaduvesh/following{/other_user}","gists_url":"https://api.github.com/users/yaduvesh/gists{/gist_id}","starred_url":"https://api.github.com/users/yaduvesh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yaduvesh/subscriptions","organizations_url":"https://api.github.com/users/yaduvesh/orgs","repos_url":"https://api.github.com/users/yaduvesh/repos","events_url":"https://api.github.com/users/yaduvesh/events{/privacy}","received_events_url":"https://api.github.com/users/yaduvesh/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-23T12:21:54Z","updated_at":"2018-10-23T13:54:12Z","closed_at":"2018-10-23T13:54:12Z","author_association":"NONE","body":"We are using Centos 7 image from docker hub (centos:7). This comes with vim-minimal package pre-installed.\r\nWhen we ran our organization's security scan on the docker image, it reported that the package vim-minimal was a very old version (7.4.160) and had security vulnerabilities. It advised to upgrade the version of vim-minimal (upgrade to atleast 7.4.629).\r\n\r\nWhen we try to find the version of the vi inside the centos image's container below is the version reported.\r\nOutput of vi --version command below:\r\n----------------------------------------------------------------\r\nVIM - Vi IMproved 7.4 (2013 Aug 10, compiled Apr 10 2018 23:54:54)\r\nIncluded patches: 1-160, 399, 402-403, 1099\r\n-----------------------------------------------------------------\r\n\r\nWe are using the latest tag of centos from docker hub. It appears that the package vim-minimal is very old (nearly 2 years old)\r\n\r\nIs there a way to get an updated centos image which has a newer version of vim-minimal?\r\nOr is it that we (and the security scan) is looking at some wrong version of this package?"}}
{"actor":{"display_login":"jperrin"}}