carrodher
commented
1 week ago I understand your concern about security vulnerabilities. We regularly update our images with the latest system packages; however, certain CVEs may persist until they are patched in the OS or application. Additionally, some CVEs remain unfixed due to the absence of available patches. In vulnerability scanners like Trivy, you can use the --ignore-unfixed flag to ignore such CVEs. You can learn more about our CVE policy here.
The Bitnami Application Catalog (OpenSource) is built on Debian 12 (Debian 11 was discontinued from the public catalog a long time ago). Additionally, as part of VMware, Bitnami offers a custom container and Helm Charts catalog based on various base images, such as Debian 11 & 12, PhotonOS 5, Ubuntu 22.04 & 24.04, RedHat UBI 8 & 9, and custom golden images. You can explore these options through the VMware Tanzu Application Catalog.
For instance, in the case of Kafka, the latest version for branch 3.7 is 3.7.1. This version contains some fixable CVEs in the Java jar itself, which is something that needs to be fixed by a new upstream release:
$ trivy image bitnami/kafka:3.7 --scanners vuln --ignore-unfixed
2024-10-28T17:26:42+01:00 INFO [vuln] Vulnerability scanning is enabled
2024-10-28T17:26:58+01:00 INFO Detected OS family="debian" version="12.7"
2024-10-28T17:26:58+01:00 INFO [debian] Detecting vulnerabilities... os_version="12" pkg_num=116
2024-10-28T17:26:58+01:00 INFO Number of language-specific files num=7
2024-10-28T17:26:58+01:00 INFO [bitnami] Detecting vulnerabilities...
2024-10-28T17:26:58+01:00 INFO [gobinary] Detecting vulnerabilities...
2024-10-28T17:26:58+01:00 INFO [jar] Detecting vulnerabilities...
2024-10-28T17:26:58+01:00 WARN Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/v0.56/docs/scanner/vulnerability#severity-selection for details.
bitnami/kafka:3.7 (debian 12.7)
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
2024-10-28T17:26:58+01:00 INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file.
Java (jar)
Total: 4 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 2, CRITICAL: 0)
┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ com.google.protobuf:protobuf-java (protobuf-java-3.23.4.jar) │ CVE-2024-7254 │ HIGH │ fixed │ 3.23.4 │ 3.25.5, 4.27.5, 4.28.2 │ protobuf: StackOverflow vulnerability in Protocol Buffers │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-7254 │
├──────────────────────────────────────────────────────────────┼────────────────┤ │ ├───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ commons-io:commons-io (commons-io-2.11.0.jar) │ CVE-2024-47554 │ │ │ 2.11.0 │ 2.14.0 │ apache-commons-io: Possible denial of service attack on │
│ │ │ │ │ │ │ untrusted input to XmlStreamReader │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-47554 │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤ ├───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ org.eclipse.jetty:jetty-http │ CVE-2024-6763 │ LOW │ │ 9.4.54.v20240208 │ 12.0.12 │ org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of │
│ (jetty-http-9.4.54.v20240208.jar) │ │ │ │ │ │ invalid authority │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-6763 │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤ │ ├──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ org.eclipse.jetty:jetty-server │ CVE-2024-8184 │ MEDIUM │ │ │ 12.0.9, 10.0.24, 11.0.24, 9.4.56 │ org.eclipse.jetty:jetty-server: jetty: Jetty │
│ (jetty-server-9.4.54.v20240208.jar) │ │ │ │ │ │ ThreadLimitHandler.getRemote() vulnerable to remote DoS │
│ │ │ │ │ │ │ attacks │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-8184 │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────┴───────────────────────────────────────────────────────────┘
Name and Version
bitnami/kafka:3.7.1-debian-12-r0
What architecture are you using?
amd64
What steps will reproduce the bug?
jf docker scan <<iamge_name>>:<<version>>I'm attaching the result below kafka:3.7.1-debian-12-r0-CVE-report.txt These issues are blocking us to deploy in fedramp environment
What is the expected behavior?
No response
What do you see instead?
CVE Report attached
Additional information
No response