Add trivy ignore for CVE-2023-52425

DiSSCo · Feb 12, 2024 · 48287fd · 48287fd
1 parent 142879f
commit 48287fd
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/.github/workflows/.trivyignore b/.github/workflows/.trivyignore
@@ -0,0 +1,4 @@
+# Date: Feb 12, 2024
+# Notes: Issue with libexpat, parsing large tokens can trigger a denial of service
+# Needs to be fixed in Docker Image.
+CVE-2023-6378
diff --git a/Dockerfile b/Dockerfile
@@ -1,10 +1,10 @@
-FROM eclipse-temurin:21-jdk-alpine AS builder
+FROM eclipse-temurin:21-jre-alpine AS builder
 WORKDIR application
 ARG JAR_FILE=target/*.jar
 COPY ${JAR_FILE} application.jar
 RUN java -Djarmode=layertools -jar application.jar extract
 
-FROM eclipse-temurin:21-jdk-alpine
+FROM eclipse-temurin:21-jre-alpine
 RUN adduser -D -u 1000 java
 WORKDIR application
 COPY --chown=java:java --from=builder application/dependencies/ ./