Hi Jaspal,

My apologies for the late reply.  Thank you for raising this to our attention.  In the future, please consider submitting an issue via https://github.com/Cisco-Talos/clamav/issues/new/choose to get our attention.

My team is new to maintaining images on Docker Hub. We hadn't yet identified the best practices for how to publish an image for the same ClamAV version with a new base image. After a little investigation, I settled on this on this scheme. 

I have published these new newly built images based on the latest Alpine Linux image (3.15.0):
The previous images remain accessible under "clamav/clamav:0.104.2_base" and "clamav/clamav:0.104.2" tags.
If we must do this again before the next patch version, the next image tags would be "0.104.2-3_base" and "0.104.2-3".
Note: the hashes for the image tags without the "_base" suffix change frequently because we update them with newer signature databases.

I also updated the following tags so that people using them can simply "pull" to get the newer image:

Regards,
Micah



Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Sandhu, Jaspal (HQP) via clamav-users <clamav-users@lists.clamav.net>
Sent: Tuesday, January 25, 2022 2:05 PM
To: clamav-users@lists.clamav.net <clamav-users@lists.clamav.net>
Cc: Sandhu, Jaspal (HQP) <jaspal.sandhu@roberthalf.com>
Subject: [clamav-users] CLAMAV: Docker Tag 0.104.2 has 9 Medium Vulnerabilities for Busy Box
 

Hi,

 

I am using the docker tag clamav/clamav:0.104.2.  Could you please help to get it fixed.  We can’t deploy this upgrade at the moment.

 

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382

 

Thanks

Jaspal Sandhu

Roberthalf