Search code examples
dockerfilesetuptoolspython-3.8

Update setuptools on Docker

I am trying to update setuptools on my Dockerfile in order to solve the vulnerability CVE-2022-40897.

However, when going to the Jfrog of the project, with neither of them appears the setuptools with a higher version than when neither of these options is followed.

I have tried the following options:

  1. RUN apk add --upgrade py3-setuptools
  2. RUN apk upgrade --no-cache py3-setuptools
  3. RUN python -m ensurepip RUN pip install --no-cache --upgrade pip setuptools

Any ideas of how can I force setuptools to be updated on the Dockerfile?

Solution

  • The vulnerability is fixed in setuptools version 65.5.1. To specify the new version of setuptools in your Dockerfile, include the following:

    RUN pip install setuptools>=65.5.1

    Alternatively, if your project contains a "requirements.txt" file, then you can add the following line to that file: setuptools>=65.5.1