Official Keycloak docker image has many critical security issues

Securing applications
#1

Official Keycloak( 10.0.1 ~ 11.0.3) docker image has many critical security issues.
How can I handle with this situation?
Would I have make my own docker image?
Do we have other secure images available?

I have a eight pages of security issues, below you can see the most critical for the first page

CVE-2019-2201, CVE-2019-14889, CVE-2019-14889, CVE-2019-18276, CVE-2019-12900, CVE-2018-20843, CVE-2018-16428 , CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-18224, CVE-2018-1000654, CVE-2020-8492

#2

Official Keycloak Docker image is based on minimal Red Hat Universal Base Image. Red Hat do a lot on the security, probably you can find any listed issue to be addressed by Red Hat. Some of them may have status won’t do, some of them patched, but dumb security scanner doesn’t recognize security patches usually.

So if you really want to satisfy your security scanner, then you need to build your own image. And of course you need to scan&build image periodically. I would say good luck.
Even with “the safest” Alpine image you may have still security issues detected (edge release may help sometimes).

#3

This is, as @jangaraj already mentioned, heavily dependent of your security scanner.

If you look at the official Docker repo of RH, quay.io, you’ll see that there are less current issues: https://quay.io/repository/keycloak/keycloak?tab=tags

Also our own Docker repo mentions just the one issue which quay.io mentions.