Upgrade (5) vulnerable packages in nginx:mainline-alpine

[JaneX8]

Can we please upgrade below vulnerable packages in the nginx:mainline-alpine? Most of the listed vulnerable packages have fixes available (see column 'FIXED-IN'). I scanned the image with https://github.com/anchore/grype.

grype.exe nginx:mainline-alpine
 ✔ Loaded image                                                                                                                                                                                                                                                                                       nginx:mainline-alpine
 ✔ Parsed image                                                                                                                                                                                                                                     sha256:c7b4f26a7d93f4f1f276c51adb03ef0df54a82de89f254a9aec5c18bf0e45ee9
 ✔ Cataloged contents                                                                                                                                                                                                                                      f102ec2b6ec24f0b6fec157468b4dc0e63f35fdecbf64c5140a0abee95a5932e
   ├── ✔ Packages                        [66 packages]
   ├── ✔ File digests                    [969 files]
   ├── ✔ File metadata                   [969 locations]
   └── ✔ Executables                     [123 executables]
 ✔ Scanned for vulnerabilities     [13 vulnerability matches]
   ├── by severity: 0 critical, 1 high, 9 medium, 3 low, 0 negligible
   └── by status:   9 fixed, 4 not-fixed, 0 ignored
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY   SEVERITY
curl        8.9.1-r1   8.11.0-r0  apk   CVE-2024-9681   Medium
curl        8.9.1-r1   8.10.0-r0  apk   CVE-2024-8096   Medium
curl        8.9.1-r1   8.11.1-r0  apk   CVE-2024-11053  Low
libcrypto3  3.3.2-r0   3.3.2-r1   apk   CVE-2024-9143   Medium
libcurl     8.9.1-r1   8.11.0-r0  apk   CVE-2024-9681   Medium
libcurl     8.9.1-r1   8.10.0-r0  apk   CVE-2024-8096   Medium
libcurl     8.9.1-r1   8.11.1-r0  apk   CVE-2024-11053  Low
libexpat    2.6.3-r0   2.6.4-r0   apk   CVE-2024-50602  Medium
libssl3     3.3.2-r0   3.3.2-r1   apk   CVE-2024-9143   Medium
tiff        4.6.0t-r0             apk   CVE-2023-52356  High
tiff        4.6.0t-r0             apk   CVE-2023-6277   Medium
tiff        4.6.0t-r0             apk   CVE-2015-7313   Medium
tiff        4.6.0t-r0             apk   CVE-2023-6228   Low

[thresheek]

Hi @JaneX8,

It seems like the current images are indeed rebuilt with the packages mentioned in the "FIXED-IN" column. At least that's what I see in the current aarch64 image.

I suppose they were rebuilt because a new Alpine release was out: docker-library/official-images#18206 - and that's how it's typically done.