有重大安全隐患

Kubeless uses bitnami/minideb:jessie as its base for a number of components. Minideb is a slimmed down packaging of upstream Debian, and as such, it provides no additional security patches beyond what is provided by Debian upstream. Debian Jessie was EOL as of Jan 2020 and no longer receives security updates. As a result, the containers based on minideb:jessie are growing a steadily longer list of critical CVE vulnerabilities. The recommended action would be to rebase on a supported version of minideb/debian. Stretch is an option for LTS support until 2022 and is well supported by the minideb project. Here is an example of a current scan on function-controller:latest performed by grype. All of the other core framework components using minideb:jessie have similar results.