search

boyter / scc

Sloc, Cloc and Code: scc is a very fast accurate code counter with complexity calculations and COCOMO estimates written in pure Go
MIT License
6.27k stars 250 forks source link

Docker: aquasec/trivy reports CRITICAL and HIGH vulnerabilities #469

Closed coiouhkc closed 1 month ago

coiouhkc commented 1 month ago

Report below for alpine 3.19.1:

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                   Title                    │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────┤
│ git     │ CVE-2024-32002 │ CRITICAL │ fixed  │ 2.43.0-r0         │ 2.43.4-r0     │ git: Recursive clones RCE                  │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-32002 │
│         ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────┤
│         │ CVE-2024-32004 │ HIGH     │        │                   │               │ git: RCE while cloning local repos         │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-32004 │
│         ├────────────────┤          │        │                   │               ├────────────────────────────────────────────┤
│         │ CVE-2024-32465 │          │        │                   │               │ git: additional local RCE                  │
│         │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-32465 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────┘

Upgrading to alpine:3.20 seems to fix the issue (for now) - are you interested in a PR?

boyter commented 1 month ago

Thanks for reporting and fixing.