search

Azure / kubernetes-volume-drivers

Kubernetes volume drivers for Azure
MIT License
126 stars 55 forks source link

Upgrade Busy box version to 1.32.0 #97

Closed snachiap closed 3 years ago

snachiap commented 3 years ago

Thanks for the wonderful library, Very much helpful with Azure Kubernetes.

Is your feature request related to a problem?/Why is this needed Current version of busybox is 1.31.1 and it has a high vulnerable issue reported by vulnerability scanning applications.

Vulnerability details below

Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".

Fix Status Fixed in busybox version 1.32.0

We can update this at our side as well. but it would be good to have actual flexvolume docker updated. So future updates can just be changing the tag.

andyzhangx commented 3 years ago

thanks for reminder, blobfuse flexvol 1.0.17 and smb flexvol 1.0.5 has been built with busybox:1.32.0