diff --git a/Dockerfile b/Dockerfile index e1134c81f47d1c647dd58385c985445d45619383..d23cf63582de3d840f4e64c8a88321dbd50df08c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -39,6 +39,8 @@ RUN /opt/bitnami/scripts/airflow/postunpack.sh && \ tar xfz /local/wheels/thrift-0.14.1.tar.gz -C /local/wheels && \ pip install --no-index --no-deps /local/wheels/thrift-0.14.1/lib/py && \ rm -rf /local/wheels/thrift-0.14.1* && \ + # Remove Elasticsearch 7.5.1 due to high findings CVE-2020-7019 CVE-2020-7021 CVE-2020-7020 CVE-2020-7014 CVE-2020-7009 + rm -rf /opt/bitnami/airflow/venv/lib/python3.8/site-packages/elasticsearch && rm -rf /opt/bitnami/airflow/venv/lib/python3.8/site-packages/elasticsearch-7.5* && \ for f in $(ls -l /local/wheels | awk '{print $9}' |sed '/^$/d'); do pip install --no-index --no-deps /local/wheels/$f; done && \ find /opt/bitnami/airflow/venv/lib/python3.8/site-packages -name "*.pem" -o -name "*.key" | egrep ".*test.*/.*\.pem|.*test.*/.*\.key" | xargs rm -f && \ rm -rf /local/* diff --git a/README.md b/README.md index 8d1b926f3315b1be652911c3dd0c245b6cc1617e..8093895f28b8d26a07b4b7de031760e71c3271b5 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,8 @@ Project template for all Iron Bank container repositories. > Airflow is a platform to programmatically author, schedule and monitor workflows. https://airflow.apache.org/ - +### Ironbank Hardened Image Notes: +apache-airflow-providers-elasticsearch will not work on this image due to vulnerabilities with Elasticsearch 7.5.1 (Removed) # TL;DR ## Docker Compose diff --git a/hardening_manifest.yaml b/hardening_manifest.yaml index 1667ee7c806c8019fae90af537ab1e19aed5e622..c7f408e1c7322b97794b003812125648141ec23b 100644 --- a/hardening_manifest.yaml +++ b/hardening_manifest.yaml @@ -73,6 +73,11 @@ resources: validation: type: sha256 value: 6ad9c7bdf517a808242b998ac20063c41532a570d088d77eec1ee12b0b5574bc +- filename: astroid-2.5.1-py3-none-any.whl + url: https://files.pythonhosted.org/packages/f1/49/d51e5ce77ea234ee416966e489283512a9852f78d9ff125747eae29e7b69/astroid-2.5.1-py3-none-any.whl + validation: + type: sha256 + value: 21d735aab248253531bb0f1e1e6d068f0ee23533e18ae8a6171ff892b98297cf # List of project maintainers maintainers: