search

canonical / pipelines-rocks

ROCKs for Kubeflow Pipelines
Apache License 2.0
1 stars 7 forks source link

Vulnerabilities found for viewer-crd-controller:2.0.5 #122

Open ckfbot opened 1 month ago

ckfbot commented 1 month ago

Vulnerabilities found for viewer-crd-controller:2.0.5


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.56/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.

charmedkubeflow/viewer-crd-controller:2.0.5-f28db97 (ubuntu 22.04)
==================================================================
Total: 0 (HIGH: 0, CRITICAL: 0)

usr/bin/controller (gobinary)
=============================
Total: 4 (HIGH: 3, CRITICAL: 1)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2023-39325 │ HIGH     │ fixed  │ v0.10.0           │ 0.17.0          │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                  │                │          │        │                   │                 │ excessive work (CVE-2023-44487)                              │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
├──────────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib           │ CVE-2024-24790 │ CRITICAL │        │ 1.20.14           │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for   │
│                  │                │          │        │                   │                 │ IPv4-mapped IPv6 addresses                                   │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│                  ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2023-45288 │ HIGH     │        │                   │ 1.21.9, 1.22.2  │ golang: net/http, x/net/http2: unlimited number of           │
│                  │                │          │        │                   │                 │ CONTINUATION frames causes DoS                               │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-45288                   │
│                  ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2024-34156 │          │        │                   │ 1.22.7, 1.23.1  │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                  │                │          │        │                   │                 │ which contains deeply nested structures...                   │
│                  │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

usr/bin/go-licenses (gobinary)
==============================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │         Installed Version          │           Fixed Version           │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2022-27191 │ HIGH     │ fixed  │ v0.0.0-20220112180741-5e0467b6c7ce │ 0.0.0-20220314234659-1baeb1ce4c0b │ golang: crash in a golang.org/x/crypto/ssh server            │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-27191                   │
├─────────────────────┼────────────────┤          │        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2022-27664 │          │        │ v0.0.0-20211112202133-69e39bad7dc2 │ 0.0.0-20220906165146-f3363e06e74c │ golang: net/http: handle server errors after sending GOAWAY  │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-27664                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2022-41723 │          │        │                                    │ 0.7.0                             │ golang.org/x/net/http2: avoid quadratic complexity in HPACK  │
│                     │                │          │        │                                    │                                   │ decoding                                                     │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-41723                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2023-39325 │          │        │                                    │ 0.17.0                            │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                     │                │          │        │                                    │                                   │ excessive work (CVE-2023-44487)                              │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
├─────────────────────┼────────────────┼──────────┤        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib              │ CVE-2024-24790 │ CRITICAL │        │ 1.20.14                            │ 1.21.11, 1.22.4                   │ golang: net/netip: Unexpected behavior from Is methods for   │
│                     │                │          │        │                                    │                                   │ IPv4-mapped IPv6 addresses                                   │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│                     ├────────────────┼──────────┤        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2023-45288 │ HIGH     │        │                                    │ 1.21.9, 1.22.2                    │ golang: net/http, x/net/http2: unlimited number of           │
│                     │                │          │        │                                    │                                   │ CONTINUATION frames causes DoS                               │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-45288                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-34156 │          │        │                                    │ 1.22.7, 1.23.1                    │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                     │                │          │        │                                    │                                   │ which contains deeply nested structures...                   │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
└─────────────────────┴────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────────────────────────┴──────────────────────────────────────────────────────────────┘

Details: https://github.com/canonical/pipelines-rocks/actions/runs/11902725190

syncronize-issues-to-jira[bot] commented 1 month ago

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/KF-6478.

This message was autogenerated