High Security issues status "Unapproved" in latest alpine docker image

Bug description

2 CVE level HIGH are detected by trivy tool.

To Reproduce

Run trivy on cloudscanner docker image build

Expected behavior

https://github.com/Boavizta/cloud-scanner/blob/cc62f0854ed4be631865bcd89197bb6cbd2f623c/Dockerfile#L19

replace to

FROM alpine AS runtime #update libcrypto3 libssl3 to fix security issues RUN apk update && apk add --upgrade libcrypto3 libssl3

JSON OUTPUT

[INFO] [2024-03-20 03:59:05 +------------+--------------------+ | STATUS | CVE SEVERITY +------------+--------------------+ | Unapproved | High CVE-2023-5363 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +------------+--------------------+ | Unapproved | High CVE-2023-5363 | libssl3 | 3.1.2-r0 | Issue summary: A bug has been identified in the processing of key and | | | initialisation vector (IV) lengths. This can lead to potential trunca | | | tion | | | or overruns during the initialisation of some symmetric ciphers. | | | Impact summary: A truncation in the IV can result in non-uniqueness, | | | which could result in loss of confidentiality for some cipher modes. | | | When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or | | | EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after | | | the key and IV have been established. Any alterations to the key leng | | | th, | | | via the "keylen" parameter or the IV length, via the "ivlen" parameter | | | , | | | within the OSSL_PARAM array will not take effect as intended, potentia | | | lly | | | causing truncation or overreading of these values. The following ciph | | | ers | | | and cipher modes are impacted: RC2, RC4, RC5, CCM, GCM and OCB. | | | For the CCM, GCM and OCB cipher modes, truncation of the IV can result | | | in | | | loss of confidentiality. For example, when following NIST's SP 800-38 | | | D | | | section 8.2.1 guidance for constructing a deterministic IV for AES in | | | GCM mode, truncation of the counter portion could lead to IV reuse. | | | Both truncations and overruns of the key and overruns of the IV will | | | produce incorrect results and could, in some cases, trigger a memory | | | exception. However, these issues are not currently assessed as securi | | | ty | | | critical. | | | Changing the key and/or IV lengths is not considered to be a common op | | | eration | | | and the vulnerable API was recently introduced. Furthermore it is like | | | ly that | | | application developers will have spotted this problem during testing s | | | ince | | | decryption would fail unless both peers in the communication were simi | | | larly | | | vulnerable. For these reasons we expect the probability of an applicat | | | ion being | | | vulnerable to this to be quite low. However if an application is vulne | | | rable then | | | this issue is considered very serious. For these reasons we have asses | | | sed this | | | issue as Moderate severity overall. | | | The OpenSSL SSL/TLS implementation is not affected by this issue. | | | The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this becaus | | | e | | | the issue lies outside of the FIPS provider boundary. | | | OpenSSL 3.1 and 3.0 are vulnerable to this issue. | --------------+-----------------+------------------------------------------------------------------------+

Additional context

For the moment, theses 2 issues are in "Unapproved" Status and latest alpine docker image not fix these security issues. As workournd, I propose to update manually to latest librairy versions of libcrypto3 & libssl3

Boavizta / cloud-scanner