search

aws-samples / aws-iot-securetunneling-localproxy

AWS Iot Secure Tunneling local proxy reference C++ implementation
https://docs.aws.amazon.com/iot/latest/developerguide/what-is-secure-tunneling.html
Apache License 2.0
73 stars 70 forks source link

Known security vulnerabilities #68

Closed volphy closed 2 years ago

volphy commented 2 years ago

I have build a Docker image using docker-build.sh script.

Architecture: aarch64 (AWS EC2 t4g instance type)

Then I push the newly built Docker image to the AWS ECR and enabled scan for vulnerabilities.

The following vulnerabilties have been found:

security_vulnerabilities

Are there plans resolve them, at least the MEDIUM severity ones?

kareali commented 2 years ago

@volphy Unfortunately those CVEs are in ubuntu which we have no control over, but I have made an update to use AmazonLinux instead which won't have those CVEs.