[Bug]: Fix the vulnerabilities in the mcr.microsoft.com/playwright:v1.56.1-jammy reported by Wiz

[khatekar]

Version

v1.56.1-jammy

Steps to reproduce

There is no bug but vulnerabilities

Expected behavior

We use the playwright base image mcr.microsoft.com/playwright:v1.56.1-jammy for our headless browser. We use Wiz to scan and find vulnerabilities. I have included the wiz reports that resolve a few vulnerabilities in the package image. Could you please suggest which version I should use to fix the majority of the vulnerabilities? Thank you, in advance.

Actual behavior

vulnerabilities

Additional context

We use the playwright base image mcr.microsoft.com/playwright:v1.56.1-jammy for our headless browser. We use Wiz to scan and find vulnerabilities. I have included the wiz reports that resolve a few vulnerabilities in the package image. Could you please suggest which version I should use to repair the majority of the vulnerabilities? Thank you, in advance.

Environment

vulnerabilities

[Skn0tt]

Are the vulnerabilities still present in the latest image? 1.58.2 is the current version.

[khatekar]

That was my goal for using the most recent 'mcr.microsoft.com/playwright:v1.58.2-jammy', I need to double-check something with the most recent image to ensure that nothing breaks in production.
But I'm not sure what the wiz scan report will be. Could anyone know if the new version patched most of the vulnerabilities?

[Skn0tt]

What vulnerabilities are being reported? Most likely they're not because of Playwright code, but because of an outdated base image. In that case a newer build won't have them.

[khatekar]

Ok, so here is the build report showing. There are total 20 High vulns. Mostly with nodejs version

Following with the latest version 'mcr.microsoft.com/playwright:v1.58.2-jammy''

Evaluated policy:
Name: FedRAMP_Vuln_Policy
Type: VULNERABILITIES
Action: AUDIT
Failed policy: FedRAMP_Vuln_Policy
Vulnerable packages: CRITICAL: 0, HIGH: 20, MEDIUM: 60, LOW: 47, INFORMATIONAL: 1
Total: 128
Vulnerabilities: CRITICAL: 0, HIGH: 20, MEDIUM: 498, LOW: 105, INFORMATIONAL: 1
Total: 624, out of which 57 are fixable

[khatekar]

This is from previous version, the latest version details yet to be collected.

# nodejs Hosted Technology	22.22.0	22.22.0	1 C 0 H 1 M 0 L	1
# jws JavaScript Code Library	3.2.3	3.2.3	0 C 3 H 0 M 0 L	1
# golang.org/x/crypto Go Code Library	0.43.0	0.43.0	0 C 1 H 0 M 0 L	1
# libswscale5 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libswresample3 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libpostproc55 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libavutil56 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libavformat58 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libavfilter7 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libavdevice58 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libavcodec58 DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# ffmpeg DPKG OS Package	-	-	0 C 0 H 10 M 0 L	1
# libsoup-3.0-common DPKG OS Package	-	-	0 C 0 H 4 M 0 L	1
# libsoup-3.0-0 DPKG OS Package	-	-	0 C 0 H 4 M 0 L	1
# libpng16-16 DPKG OS Package	1.6.37-3ubuntu0.3	1.6.37-3ubuntu0.3	0 C 0 H 4 M 0 L	1
# libcups2 DPKG OS Package	2.4.1op1-1ubuntu4.16	2.4.1op1-1ubuntu4.16	0 C 0 H 2 M 0 L	1
# libavahi-common3 DPKG OS Package	0.8-5ubuntu5.4	0.8-5ubuntu5.4	0 C 0 H 2 M 0

[Skn0tt]

Those are all in the base OS. If you care about these scan reports, I recommend you build your own Dockerfile based off of https://github.com/microsoft/playwright/blob/main/utils/docker/Dockerfile.jammy, that'll make it much easier for you to rebuild when needed. Instead of COPY ./playwright-core.tar.gz /tmp/playwright-core.tar.gz, you can probably install from NPM.

[khatekar]

Thanks for your response Simon. Yes, I'm using it in the Dockerfile: "FROM mcr.microsoft.com/playwright:v1.58.2-jammy"; I believe I also used it with the npm package, but it had some other issues, such as causing problems with loading the URL in a headless browser and missing portions. So I decided to use the playwright's base image. I'll re-try though. Thanks again.