I'm trying to build a base image that pulls from php:7.3-fpm, which is built on debian:buster-slim. The php:7.3-fpm base image has vulnerabilities out of the box, like https://security-tracker.debian.org/tracker/CVE-2019-3844 and https://security-tracker.debian.org/tracker/CVE-2019-19603. From the look of it, there are no fixes for them other than changing the base OS. Is my understanding correct? I assumed that any high severity vulnerabilities would have fixes available on buster but that doesn't seem to be the case. How do I go about fixing these things? I thought adding an apt-get upgrade to the Dockerfile may do the trick, but no upgrades are performed. Maybe there's a repository out there I can add to /etc/apt/sources.list? Any insight would be greatly appreciated!
The Debian and Ubuntu projects maintain a list of "unfixed" vulnerabilities which they've assessed and decided not to patch. One of the problems with vulnerability scanning container images is that most of the tools default to reporting those unfixed issues (it's worth noting that "traditional" vulnerability scanners don't usually report unfixed issues at all, more info here)
With Trivy there's an
--ignore-unfixed option which will provide a report without those issues.
In the case of
php:7.3-fpm on Docker hub adding that option takes the vulnerability count from 565 issues to 1.
Depending on your threat model, you might want to use a vulnerability scanner which ignores unfixed vulnerabilities or you might want to manually compile fixed versions of packages that are included in the container image which you use and where the vulnerabilities are relevant to you.
From those links you posted, it is clear that Debian is not patching them because they consider them too minor and or unrealistic to exploit:
CVE-2019-19603 [buster] - sqlite3 (Minor issue, too intrusive to backport)
CVE-2019-3844 [buster] - systemd (Minor issue; exploit vector needs control both of the service and a helper
The high severity could be overstated, but only you can determine if the above notes are good enough for your threat model.
If not, you could download the newer, patched versions of these programs and build them from source. It also looks like the issues may be fixed in Debian sid (unstable). You could try to configure apt to install these newer versions, but it may cause dependency issues.