My Dockerfile based on php:8.2-fpm-alpine3.17. Recently, Amazon Inspector found out a vulnerability CVE-2023-49468 in my image, in libde265 (version 1.0.12-r0). I checked that vulnerability was fixed in libde265 (version 1.0.15-r0) here. I checked libde265 package on the official site alpine and realised that alpine 3.17 already use libde265 (version 1.0.15-r0).
Why when I re-build my docker image via docker build --no-cache command my image is still has libde265 (version 1.0.12-r0.X86_64) so I can't fix vulnerability ?
Alpine 3.17 is still supported for security fixes until 2024-11-22, is it correct that will be release after this date and my image pull new base image automatically and the vulnerability will disappear ?
I have a hierarchy of images (one is inherited by the other). It was necessary to update each of the parent images using the command docker build --no-cache