Self Hosted Retool dockerfile vulnerability

kakuto · April 24, 2023, 9:48pm

I have detected a number of vulnerabilities in the dockerfile obtained from the official retool. I will list them below as samples.Please let us know how you are taking countermeasures and if you have any knowledge about them.

CVE-2022-27140 express-fileupload
CVE-2022-2421 socket.io-parser, socket.io-parser
CVE-2022-37614 mockery
CVE-2022-35949 undici
CVE-2020-12265 decompress-tar
CVE-2023-29017 vm2, vm2
CVE-2023-22578 sequelize
CVE-2023-25813 sequelize
CVE-2021-44906 minimist, minimist, minimist, minimist
CVE-2020-28499 merge
CVE-2023-28154 webpack, webpack, webpack

Tess · May 4, 2023, 10:47pm

Hi @kakuto I checked in with our security team & they mentioned you connected with them already Let me know if I can help with anything

kakuto · May 9, 2023, 12:07am

Thank you very much. This case is closed and not a problem.