diff --git a/Dockerfile b/Dockerfile index 4767dcde0c68fe1fa75ee7c3e023444650be38e1..873db8824d7585d18c9f01270decddca8c542255 100644 --- a/Dockerfile +++ b/Dockerfile @@ -39,6 +39,8 @@ RUN /opt/bitnami/scripts/airflow-scheduler/postunpack.sh && \ tar xfz /local/wheels/thrift-0.14.1.tar.gz -C /local/wheels && \ pip install --no-index --no-deps /local/wheels/thrift-0.14.1/lib/py && \ rm -rf /local/wheels/thrift-0.14.1* && \ + # Remove Elasticsearch 7.5.1 due to high findings CVE-2020-7019 CVE-2020-7021 CVE-2020-7020 CVE-2020-7014 CVE-2020-7009 + rm -rf /opt/bitnami/airflow/venv/lib/python3.8/site-packages/elasticsearch && rm -rf /opt/bitnami/airflow/venv/lib/python3.8/site-packages/elasticsearch-7.5* && \ for f in $(ls -l /local/wheels | awk '{print $9}' |sed '/^$/d'); do pip install --no-index --no-deps /local/wheels/$f; done && \ find /opt/bitnami/airflow/venv/lib/python3.8/site-packages -name "*.pem" -o -name "*.key" | egrep ".*test.*/.*\.pem|.*test.*/.*\.key" | xargs rm -f && \ rm -rf /local/* diff --git a/README.md b/README.md index f4f9970e6bb6b6628a036012b43f2c15bc2b8791..b0bb56421b80b2e7a9f93b80e4437975fb6601f4 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,8 @@ > Airflow is a platform to programmatically author, schedule and monitor workflows. Airflow Scheduler is one of the required components when the CeleryExecutor is configured. https://airflow.apache.org/ - +### Ironbank Hardened Image Notes: +apache-airflow-providers-elasticsearch will not work on this image due to vulnerabilities with Elasticsearch 7.5.1 (Removed) # TL;DR ## Docker Compose diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index 9552c8f0f1529614da7e709a6fc6f68cbe914f10..2a4feb5bd6b5b2e9f28263b331839d15dcfaa35a 100644 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -73,10 +73,15 @@ resources: validation: type: sha256 value: 6ad9c7bdf517a808242b998ac20063c41532a570d088d77eec1ee12b0b5574bc +- filename: astroid-2.5.1-py3-none-any.whl + url: https://files.pythonhosted.org/packages/f1/49/d51e5ce77ea234ee416966e489283512a9852f78d9ff125747eae29e7b69/astroid-2.5.1-py3-none-any.whl + validation: + type: sha256 + value: 21d735aab248253531bb0f1e1e6d068f0ee23533e18ae8a6171ff892b98297cf # List of project maintainers maintainers: - name: "Austin Denton" username: "austindenton" email: "austindenton@seed-innovations.com" - cht_member: false + cht_member: false \ No newline at end of file