Re: BUG #18702: Critical & High Security vulnerability issue with Trivy Scan in postgres 16

> On 12 Nov 2024, at 11:12, PG Bug reporting form <noreply(at)postgresql(dot)org> wrote:

> We are using postgres 16 docker image from hub and we found some Critical
> and High vulnerability.

The postgres docker image is not maintained by the postgres committers, the
page on docker.com lists (and links to) "Maintained by: the PostgreSQL Docker
Community" as the ones you should be contacting. They may call it "Docker
Official Image" but that doesn't mean it's official by postgresql.org.

> This fix is essential for our releases. Please provide fix for the
> vulnerability issue below.

While it's none of my business, but if something which you are unsure over who
maintains is essential to your business, then maybe consider compiling a Docker
image yourself inhouse?

--
Daniel Gustafsson