Docker image for ruby 2.5.4 and 2.6.2

[kxhitiz]

There was recent ruby release (ruby 2.5.4, 2.6.2) for the vulnerabilities https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/

When should we expect the corresponding docker image to be available on circle?

[halfer]

RubyGems vulnerability March 2019

Ruby announced some CVEs recently for certain RubyGems versions. It doesn’t appear that the docker containers have been updated yet: $ docker pull circleci/ruby:2.6.1 2.6.1: Pulling from circleci/ruby Digest: sha256:6e7c310c2aafcb504adde04ce9202d52da8da0bfdb40cceed3204094851d4ab1 Status: Image is up to date for circleci/ruby:2.6.1 ~/Workbench $ docker run -it --rm circleci/ruby:2.6.1 gem -v 3.0.1 Would expect 3.0.3 to be the output above, in order to fix you would need to run gem update -…

[PhilCoggins]

You can verify this yourself:

$ docker pull circleci/ruby:2.6.1
$ docker run -it --rm circleci/ruby:2.6.1 bash
$ gem -v
# Expect 3.0.3

[henrik]

Now there’s a Ruby 2.5.5 with further security fixes No circleci/ruby docker image tag yet.

[henrik]

If anyone else wants the security updates quickly, feel free to use these that my co-worker Jocke just made:

• auctionet/ruby:2.5.5-alpine
• auctionet/circleci-ruby:2.5.5
• auctionet/circleci-ruby:2.6.2
• auctionet/circleci-ruby:2.6.2-node

So a Dockerfile could say e.g.

FROM auctionet/ruby:2.5.5-alpine

Or config could say e.g.

- image: auctionet/circleci-ruby:2.5.5

[joakimk]

Wrote up a quick thing on how I built the ruby alpine image. https://gist.github.com/joakimk/854d190bb8423a807ac1f696925443cd

[drazisil]

Our image release schedule is here https://circleci.com/blog/build-image-update-schedule/

It’s an automated process so I would expect it to be updated within the next day.