Critical CVE in cassandra bootstrap image v0.1.10 - Githubissues

cscetbon / casskop

This Kubernetes operator automates Cassandra operations such as deploying rack aware clusters, scaling up and down, configuring C* and its JVM, upgrading JVM and C*, backup/restores and many more...

https://cscetbon.github.io/casskop/

Apache License 2.0

13 stars 8 forks source link

Critical CVE in cassandra bootstrap image v0.1.10 #94

Closed AKamyshnikova closed 1 year ago

AKamyshnikova commented 1 year ago

Bug Report

zlib (1:1.2.11.dfsg-2+deb11u1) ____[CVE-2022-37434|debian:11] (1:1.2.11.dfsg-2+deb11u2) (PaclairProcessor) | https://security-tracker.debian.org/tracker/CVE-2022-37434 CVSS V3 9.8 CRITICAL
libtasn1-6 (4.16.0-2) ____[CVE-2021-46848|debian:11] (4.16.0-2+deb11u1) (PaclairProcessor) | https://security-tracker.debian.org/tracker/CVE-2021-46848 CVSS V3 9.1 CRITICAL

Critical CVE found by CVE tracker in cassandra-bootstrap image.

Required rebuild using fresher bitnami/minideb:bullseye base image.