Update OpenSSL package to mitigate CVE-2023-5363

Aurelian-Shuttleworth · Aurelian-Shuttleworth · commit 65b37fb97265 · 2023-12-04T17:30:12.000+01:00
OpenSSL package was updated in the Dockerfile to mitigate potential threats associated with vulnerability CVE-2023-5363. Specifically, the command "RUN apk add --no-cache --upgrade "openssl>=3.1.4-r1"" was added to ensure an updated version of OpenSSL is used which addresses the mentioned vulnerability. This enhances the overall security of our Docker containerised application. Signed-off-by: Aurelian Shuttleworth <aurelian@shuttleworth.tech>
diff --git a/Dockerfile b/Dockerfile
@@ -23,6 +23,9 @@ RUN make build
 
 FROM alpine:3.18.4
 
+# Mitigate CVE-2023-5363
+RUN apk add --no-cache --upgrade "openssl>=3.1.4-r1"
+
 COPY --from=builder /go/src/terraform-docs/bin/linux-amd64/terraform-docs /usr/local/bin/
 
 ENTRYPOINT ["terraform-docs"]
