I saw that the `ssh-run` bitbucket pipeline still relies on `alpine:3.9` container image.
https://bitbucket.org/atlassian/ssh-run/src/798568418ced843e20e6465092a74b1a04a8dd66/Dockerfile#lines-1
As far as i could find the security updates for that release were stopped on 01 Jan 2021
I suspect that this old release includes many security issues which were fixed in newer versions of alpine linux.
This should definitely be fixed as this container has access to private keys used to deploy software to production systems.
@Stephan Eicher hi. The alpine image updated in following pipes:
Regards, Igor
@Stephan Eicher hi. Thanks for your investigation.We will update the ssh-run pipe docker image and notify you.
The following pipelines are also affected:
@Stephan Eicher hi. According to this page:
python 3.10 EOL will be 2026-10, so no changes needed.
But we will update alpine image in your listed in the comments pipes.
We have more than 50 pipes to maintain, so, unfortunately, our strategy usually when no new features to be implemented is to wait for users feature request.You could always ask us in the community to bump a pipe version or even create a pull-request by yourself since it is open-sourced.
Also keep in mind that pipes are not the same as pipelines.
Pipes provide a simple way to configure a pipeline. They are especially powerful when you want to work with third-party tools. More details here.
It looks like you're new here. Sign in or register to get started.
