# How to fix Keycloak 14 Vulnerable RPMs

**URL:** https://forum.keycloak.org/t/how-to-fix-keycloak-14-vulnerable-rpms/15412
**Category:** Getting advice
**Created:** [May 6, 2022, 11:25pm UTC](https://forum.keycloak.org/t/how-to-fix-keycloak-14-vulnerable-rpms/15412 "2022-05-06T23:25:25Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![kabi.patt](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kabi.patt/32/8040_2.png) [@kabi.patt](https://forum.keycloak.org/u/kabi.patt)
#### Post date: [May 6, 2022, 11:25pm UTC](https://forum.keycloak.org/t/how-to-fix-keycloak-14-vulnerable-rpms/15412/1 "2022-05-06T23:25:26Z")

</div>

We are using keycloak 14 (container) and our scanner is complaining of few vulnerable RPMs available in the container. One example is, glibc-2.28-164.el8\_5.3.x86\_64.rpm which can be fixed by upgrading to glibc-2.35.

We have added the “yum update -y” on top of the keycloak image in our Dockerfile that suppose to take care of updating all the existing RPMs to latest.

```auto
FROM jboss/keycloak:14.0.0

USER root
RUN microdnf install yum && yum clean all && yum update -y 

```

However, The “yum update” calls is not able to fetch the latest repo. The possible reason could be, the use of a bare minimum “Universal Base Image” (RHEL) in the Keycloak container.

Anyone has fixed this issue? What are the best practice to fix this ongoing issue ? Should we go for a custom image that has our full Linux and JDK with keycloak jar on top of it?