Critical Vulnerabilities found in ckan-base images

[alice-boe]

The below packages were reported with critical security vulnerabilities in the ckan-base images used from https://hub.docker.com/. Please advise on remediation steps?

ckan-base-datapusher/0.0.21 (10 security vulnerabilities)

•3.14:wget:1.21.1-r1 
	- CVE-2024-38428
• 3.14:libssl1.1:1.1.1t-r2
	- CVE-2023-49210
• 3.14:libressl3.3-libssl:3.3.6-r0
	- CVE-2023-35784
• 3.14:python3:3.9.16-r0
	- CVE-2022-37454
• 3.14:ssl_client:1.33.1-r8
	- CVE-2022-48174 
	- CVE-2021-42377 
• certifi:2020.12.5
	- CVE-2023-37920
• 3.14:py3-certifi:2020.12.5-r1
	- CVE-2023-3792
• 3.14:libressl3.3-libcrypto:3.3.6-r0
	- CVE-2021-46880

ckan/ckan-solr/2.10-solr9 (6 vulnerabilities)

• github.com/golang/go:1.18.1
	- CVE-2023-24538
	- CVE-2023-29402
	- CVE-2023-29404
	- CVE-2023-29405
	- CVE-2023-24540
	- CVE-2024-24790	

ckan/ckan-base/2.11 (1 vulnerability)

• debian:bookworm:zlib1g:1:1.2.13.dfsg-1
	- CVE-2023-45853

[kowh-ai]

Thanks @alice-boe for this - we are looking into this ASAP

[alice-boe]

Hi, any update here? What strategy should we follow regarding these vulnerabilities?