Vulnerability Reportrust:1.99.0-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The inherited packages include serious image-parsing and glibc issues, such as CVE-2023-5841 and CVE-2019-1010023, which could let an attacker trigger heap overflows or code execution if the final image processes untrusted files or runs ldd on malicious ELF files. The glibc ldd issue is fully mitigated by never running ldd on untrusted ELF files, and the OpenEXR issue is avoided by not parsing untrusted OpenEXR files. These findings matter only when the built image actually invokes those libraries on attacker-controlled inputs; otherwise, they remain inherited but lower-risk. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.