The launchpad extension has critical security vulnerabilities in the latest images

[justinmchase]

The latest image of mssql/server:2022-latest contains a file at /opt/mssql-extensibility/bin/launchpad which appears to be built with a very old version of golang and generates a large number of critical CVE's for all of your published images.

exact sha256

as of Aug 27, 2024

c1aa8afe9b06eab64c9774a4802dcd032205d1be785b1fd51e1c0151e7586b74

---

Details

Please rebuild the launchpad extension with a newer version of golang and publish an updated version of 2022 and 2019.

• CVE-2023-29404
• CVE-2023-24540
• CVE-2019-14809
• CVE-2023-29402
• CVE-2023-24538
• CVE-2022-23806
• CVE-2021-38297
• CVE-2019-11888
• CVE-2023-29405

---

Related to

• Security vulnerabilites identified in sqlserver linux docker image #866

[amitkh-msft]

Ack. Thank you for sharing this. We will work on updating the golang package.

[naman7kr]

Any update on this ? is there any deadline ?

[amitkh-msft]

sorry for the delay, hopefully I should have a tentative timeline to share by end of next week.

[granadacoder]

Hi.

I am another person and team being completely paralyzed here.

When giving timeline phrases... could you use exact dates and please avoid "this week" or "next week" phrases. I'm not trying to be a jerk, but I'm getting pinged twice a day on "what is the update?".
I am in a zero tolerance world now.

Thank you for your consideration.

[justinmchase]

@amitkh-msft I'm in the same boat. These images are being blocked by our security team and they are critical for our developers.

[granadacoder]

sorry for the delay, hopefully I should have a tentative timeline to share by end of next week.

(Posted 3 weeks ago)

Hi.

We are desperately looking for an update.

We are looking to shift to postgres now because of the lack of response.

I'm not trying to be nasty. I'm conveying the reality of our security department will not allow vulnerable images.

[FabiKund]

@amitkh-msft are there any updates on the timeline?

We have the same problem that several people have already described here: one of our products needs to use the mssql server image which contains the vulnerabilities stated above.
As long as the vulnerabilities exist our security department does not allow going live with the product and blocks the usage of the image.

[granadacoder]

Hi. It's coming up on 2 MONTHS since being reported.

Please, can we get an update?

[hype11]

Hi, I have the same problem. For our company the image is blocked by security scanners. How long will it take to fix this critical issue?
regards

[naman7kr]

i have stopped using mssql database, thanks to @amitkh-msft

[granadacoder]

4 1/2 MONTHS later...we still have no update?

This is embarrassing Microsoft.