The most popular docker images each contain at least 30 vulnerabilities

Re:The most popular docker images each contain at least 30 v... by cellularmitosis on Tuesday February 26, 2019 @02:57PM (#19257795)

What you are describing is known as the distinction between a "local exploit" vs. a "remote exploit".

https://en.wikipedia.org/wiki/Exploit_(computer_security)#Cl...

Side note: this is why it is more difficult (from a security perspective) to run a computer lab than to host a web application. Much greater attack surface area when you have users who have shell access.

[ Parent | on HN ]

Re:The most popular docker images each contain at least 30 v... by DCKing on Tuesday February 26, 2019 @03:29PM (#19258039)

No I'm not.

It doesn't matter whether an exploit is locally or remotely exploitable potentially. It matters whether it's exploitable for an attacker.

For example, CVE-2017-5645 is a remote code execution vulnerability in Log4j that will light up your vulnerability scanner like a Christmas tree, but requires you to use Log4j functionality that you will never realistically use in an application container.

[ Parent | on HN ]