<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-5363" rel="nofollow noreferrer">CVS-2023-5363</a> and <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-5678" rel="nofollow noreferrer">CVE-2023-5678</a> are both vulnerabilities in OpenSSL. They don't come from any of the code that you wrote. Your base image - <code>node:21-alpine</code> - probably has a vulnerable version of OpenSSL by default. By adding the commands to update installed packages, you are installing a patched version of OpenSSL that no longer contains the vulnerabilities.</p>

CC BY-SA 4.0
2023-11-29T13:03:23.457Z
2023-11-29T13:03:23.457Z
Thomas Owens
<p>I added this line to my <code>make.dockerfile</code></p>
<pre><code>RUN apk update &amp;&amp; \
    apk upgrade &amp;&amp; \
    apk add --no-cache openssl

</code></pre>
<p>So now my code looks like:</p>
<pre><code>FROM node:21-alpine

WORKDIR /api
RUN apk update &amp;&amp; \
    apk upgrade &amp;&amp; \
    apk add --no-cache openssl

COPY ./package*.json ./

RUN mkdir ./src
COPY ./src/ ./src/

RUN npm install
ENTRYPOINT [ &quot;echo&quot;, &quot;'All Done'&quot; ]

</code></pre>

CC BY-SA 4.0
2023-11-29T02:09:09.243Z
2023-11-29T02:09:09.243Z
learningtech
<p>Dockerhub says I have the vulnerabilities: CVE-2023-5363 and CVE-2023-5678, which is part of the openssl package.
See this image:
<a href="https://i.sstatic.net/1QQhu.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/1QQhu.png" alt="enter image description here" /></a></p>
<p>Does anyone know how I can resolve this issue?  I've simplified my nodejs project to just <code>console.log('hello world');</code> and I removed all possible npm packages, but I still get this vulnerability.  My <code>hello</code> project only consists of 4 files and they are:</p>
<p><code>~/src/index.js</code></p>
<pre><code>console.log('hello');
</code></pre>
<p><code>~/package.json</code></p>
<pre><code>{
  &quot;name&quot;: &quot;test&quot;,
  &quot;version&quot;: &quot;1.0.0&quot;,
  &quot;main&quot;: &quot;src/index.js&quot;,
  &quot;scripts&quot;: {},
  &quot;dependencies&quot;: {},
  &quot;devDependencies&quot;: {}
}
</code></pre>
<p><code>~/docker-compose.yml</code></p>
<pre><code>version: &quot;3.8&quot;
services:
  api_image:
    image: johndev/api:test2
    build:
      context: ./
      dockerfile: ./make.dockerfile
</code></pre>
<p><code>~/make.dockerfile</code></p>
<pre><code>FROM node:21-alpine

WORKDIR /api

COPY ./package*.json ./

RUN mkdir ./src
COPY ./src/ ./src/

RUN npm install
ENTRYPOINT [ &quot;echo&quot;, &quot;'All Done'&quot; ]
</code></pre>
<p>To push an image to dockerhub, I just run these commands:</p>
<pre><code>docker-compose up --build -d;
docker push johndev/api:test2;
</code></pre>
<p>What did I do wrong?  What in my code is causing the vulnerabilities CVE-2023-5363 and CVE-2023-5678?</p>

<docker-compose><node.js><dockerhub><npm>
Dockerhub says Hello World causes CVE-2023-5363 and CVE-2023-5678
learningtech
# Dockerhub says Hello World causes CVE-2023-5363 and CVE-2023-5678

(Asked by: username_0 on 2023-11-29)

Dockerhub says I have the vulnerabilities: CVE-2023-5363 and CVE-2023-5678, which is part of the openssl package.
See this image:

Does anyone know how I can resolve this issue?  I've simplified my nodejs project to just console.log('hello world'); and I removed all possible npm packages, but I still get this vulnerability.  My hello project only consists of 4 files and they are:
~/src/index.js
console.log('hello');

~/package.json
{
  "name": "test",
  "version": "1.0.0",
  "main": "src/index.js",
  "scripts": {},
  "dependencies": {},
  "devDependencies": {}
}

~/docker-compose.yml
version: "3.8"
services:
  api_image:
    image: johndev/api:test2
    build:
      context: ./
      dockerfile: ./make.dockerfile

~/make.dockerfile
FROM node:21-alpine

WORKDIR /api

COPY ./package*.json ./

RUN mkdir ./src
COPY ./src/ ./src/

RUN npm install
ENTRYPOINT [ "echo", "'All Done'" ]

To push an image to dockerhub, I just run these commands:
docker-compose up --build -d;
docker push johndev/api:test2;

What did I do wrong?  What in my code is causing the vulnerabilities CVE-2023-5363 and CVE-2023-5678?

**Tags:** docker-compose, node.js, dockerhub, npm


---

## 2 answers

### Answer by username_1 on 2023-11-29. Score: 1

[CVS-2023-5363](https://nvd.nist.gov/vuln/detail/CVE-2023-5363) and [CVE-2023-5678](https://nvd.nist.gov/vuln/detail/CVE-2023-5678) are both vulnerabilities in OpenSSL. They don't come from any of the code that you wrote. Your base image - `node:21-alpine` - probably has a vulnerable version of OpenSSL by default. By adding the commands to update installed packages, you are installing a patched version of OpenSSL that no longer contains the vulnerabilities.


---

### Answer by username_0 on 2023-11-29. Score: 0

I added this line to my make.dockerfile
RUN apk update && \
    apk upgrade && \
    apk add --no-cache openssl


So now my code looks like:
FROM node:21-alpine

WORKDIR /api
RUN apk update && \
    apk upgrade && \
    apk add --no-cache openssl

COPY ./package*.json ./

RUN mkdir ./src
COPY ./src/ ./src/

RUN npm install
ENTRYPOINT [ "echo", "'All Done'" ]


---

