aspnet:10.0 Noble image still contains GnuTLS packages flagged by Ubuntu 24.04 security scan

[vrecluse]

Describe the issue

The current Linux/amd64 image for mcr.microsoft.com/dotnet/aspnet:10.0 / mcr.microsoft.com/dotnet/aspnet:10.0.8-noble still contains Ubuntu Noble packages that are being reported by AWS Inspector/ECR vulnerability scanning as Critical/High GnuTLS findings.

I understand from the .NET Docker vulnerability workflow that distro package findings are usually handled by the base distro/image update process. I am filing this because the Ubuntu security notice appears to have fixed versions available for at least the GnuTLS issues, while the current published aspnet:10.0 Noble image still contains the previous package version.

Affected image

• Image: mcr.microsoft.com/dotnet/aspnet:10.0.8-noble
• Same Linux/amd64 manifest as mcr.microsoft.com/dotnet/aspnet:10.0 at the time I checked
• Linux/amd64 manifest digest: sha256:a7f704b4b87284c80df9b90ab0e06810a241785204dc191ec05f2b26b5847623
• OS inside image: Ubuntu 24.04.4 LTS (Noble Numbat)

Package versions observed in the image

Extracted from /var/lib/dpkg/status in the published image layers:

libgnutls30t64  3.8.3-1.1ubuntu3.5
libgcrypt20     1.10.3-2build1
liblzma5        5.6.1+really5.4.5-1ubuntu0.2
libicu74        74.2-1ubuntu3.1
tzdata          2026a-0ubuntu0.24.04.1

Example findings reported against libgnutls30t64:3.8.3-1.1ubuntu3.5 / source package gnutls28:3.8.3-1.1ubuntu3.5 include:

• CVE-2026-42010 (Critical)
• CVE-2026-33845 (Critical)
• CVE-2026-5260 (High)
• CVE-2026-33846 (High)
• CVE-2026-42013 (High)
• CVE-2026-42009 (High)
• CVE-2026-42012 (High)
• CVE-2026-3833 (High)
• CVE-2026-42011 (High)
• CVE-2026-42015 (Medium)
• CVE-2026-3832 (Low)
• CVE-2026-5419 (Low)

Ubuntu notice/reference:

• https://ubuntu.com/security/notices/USN-8284-1
• https://ubuntu.com/security/CVE-2026-42010
• https://ubuntu.com/security/CVE-2026-33845

USN-8284-1 lists gnutls28 fixed in Ubuntu 24.04 LTS (Noble) as 3.8.3-1.1ubuntu3.6, but the current aspnet:10.0.8-noble image still has 3.8.3-1.1ubuntu3.5.

Chiseled image comparison

I also checked mcr.microsoft.com/dotnet/aspnet:10.0.8-noble-chiseled-extra on Linux/amd64:

• Manifest digest: sha256:d3552fc1bd9b5195f6a397a547975fa1dbfb21870b4710f929eaa9adc5ceee42
• OS: Ubuntu 24.04.4 LTS
• It contains tzdata and libicu74, but I did not find libgnutls30t64, gnutls28, libgcrypt20, xz-utils, or liblzma5 in /var/lib/dpkg/status.

That image is a workable mitigation for apps that can use chiseled images, but some users may still expect the non-chiseled Noble image to receive the Ubuntu security update.

Expected behavior

A refreshed mcr.microsoft.com/dotnet/aspnet:10.0 / 10.0.8-noble image should include the Noble security update for GnuTLS, or the docs/vulnerability workflow should clarify whether users should switch to 10.0-noble-chiseled-extra or a custom ContainerBaseImage until the base image refresh happens.

Repro / verification

I verified without Docker daemon by pulling the Linux/amd64 manifest and extracting the published image layers from MCR, then reading /var/lib/dpkg/status.

Equivalent check once pulled locally:

docker run --rm mcr.microsoft.com/dotnet/aspnet:10.0.8-noble \
  dpkg-query -W libgnutls30t64 libgcrypt20 liblzma5 tzdata

Configuration

• Architecture checked: linux/amd64
• Image family: ASP.NET Core runtime image
• Tags checked: 10.0, 10.0.8-noble, 10.0.8-noble-chiseled-extra

[mthalman]

I understand from the .NET Docker vulnerability workflow that distro package findings are usually handled by the base distro/image update process. I am filing this because the Ubuntu security notice appears to have fixed versions available for at least the GnuTLS issues, while the current published aspnet:10.0 Noble image still contains the previous package version.

While it may be marked as fixed in the security notice, the base Noble image doesn't yet contain that fix. Once that is updated the aspnet image will be rebuilt on that.

$ docker run --rm ubuntu.azurecr.io/ubuntu:noble apt list libgnutls30t64

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Listing...
libgnutls30t64/now 3.8.3-1.1ubuntu3.5 amd64 [installed,local]

cc @cjdcordeiro