> On 12 Nov 2024, at 11:12, PG Bug reporting form <noreply@postgresql.org> wrote:
> We are using postgres 16 docker image from hub and we found some Critical
> and High vulnerability.
The postgres docker image is not maintained by the postgres committers, the
page on docker.com lists (and links to) "Maintained by: the PostgreSQL Docker
Community" as the ones you should be contacting. They may call it "Docker
Official Image" but that doesn't mean it's official by postgresql.org.
> This fix is essential for our releases. Please provide fix for the
> vulnerability issue below.
While it's none of my business, but if something which you are unsure over who
maintains is essential to your business, then maybe consider compiling a Docker
image yourself inhouse?
--
Daniel Gustafsson
