zookeeper-exporter image has 1 Compliance and 44 Fixable Vulnerabilities

[umang8223]

ISSUE

• 1 Compliance and 44 Fixable Vulnerabilities found in zookeeper-exporter image after doing the twistlock scan on it.

• 1 compliance

  {
  "complianceFailureSummary": "C:0|H:1|M:0|L:0|T:1",
  "vulnerabilityFailureSummary": "C:5|H:30|M:11|L:1|T:47",
  "complianceDistribution": {
  "critical": 0,
  "high": 1,
  "medium": 0,
  "low": 0,
  "total": 1
  },
  "vulnerabilityDistribution": {
  "critical": 5,
  "high": 30,
  "medium": 11,
  "low": 1,
  "total": 47
  }
  }
  
  Detailed Report of Compliance for image
  {
  "text": "",
  "id": 41,
  "severity": "high",
  "cvss": 0,
  "status": "",
  "cve": "",
  "cause": "",
  "description": "It is a good practice to run the container as a non-root user, if possible. Though user\nnamespace mapping is now available, if a user is already defined in the container image, the\ncontainer is run as that user by default and specific user namespace remapping is not\nrequired",
  "title": "(CIS_Docker_v1.3.1 - 4.1) Image should be created with a non-root user",
  "vecStr": "",
  "exploit": "",
  "link": "",
  "type": "image",
  "packageName": "",
  "packageVersion": "",
  "layerTime": 0,
  "templates": [
  "PCI",
  "DISA STIG"
  ],
  "twistlock": false,
  "cri": false,
  "published": 0,
  "fixDate": 0,
  "discovered": "0001-01-01T00:00:00Z",
  "functionLayer": "",
  "severityCHML": "H"
  }

• CVE links for 44 Fixable Vulnerabilities:

  1. https://nvd.nist.gov/vuln/detail/CVE-2018-25032
  2. https://nvd.nist.gov/vuln/detail/CVE-2022-37434
  3. https://nvd.nist.gov/vuln/detail/CVE-2021-4160
  4. https://nvd.nist.gov/vuln/detail/CVE-2022-0778
  5. https://nvd.nist.gov/vuln/detail/CVE-2022-1292
  6. https://nvd.nist.gov/vuln/detail/CVE-2022-2068
  7. https://nvd.nist.gov/vuln/detail/CVE-2022-2097
  8. https://nvd.nist.gov/vuln/detail/CVE-2022-32189
  9. https://nvd.nist.gov/vuln/detail/CVE-2022-30633
  10. https://nvd.nist.gov/vuln/detail/CVE-2022-32148
  11. https://nvd.nist.gov/vuln/detail/CVE-2021-33196
  12. https://nvd.nist.gov/vuln/detail/CVE-2021-38297
  13. https://nvd.nist.gov/vuln/detail/CVE-2021-34558
  14. https://nvd.nist.gov/vuln/detail/CVE-2021-39293
  15. https://nvd.nist.gov/vuln/detail/CVE-2022-28327
  16. https://nvd.nist.gov/vuln/detail/CVE-2022-27664
  17. https://nvd.nist.gov/vuln/detail/CVE-2022-2879
  18. https://pkg.go.dev/vuln/GO-2022-1095
  19. https://nvd.nist.gov/vuln/detail/CVE-2021-41771
  20. https://nvd.nist.gov/vuln/detail/CVE-2022-2880
  21. https://nvd.nist.gov/vuln/detail/CVE-2022-41715
  22. https://nvd.nist.gov/vuln/detail/CVE-2021-41772
  23. https://nvd.nist.gov/vuln/detail/CVE-2022-30580
  24. https://nvd.nist.gov/vuln/detail/CVE-2021-33195
  25. https://nvd.nist.gov/vuln/detail/CVE-2021-44716
  26. https://nvd.nist.gov/vuln/detail/CVE-2022-30631
  27. https://nvd.nist.gov/vuln/detail/CVE-2022-30630
  28. https://nvd.nist.gov/vuln/detail/CVE-2022-28131
  29. https://nvd.nist.gov/vuln/detail/CVE-2022-24921
  30. https://nvd.nist.gov/vuln/detail/CVE-2022-30632
  31. https://nvd.nist.gov/vuln/detail/CVE-2022-1705
  32. https://nvd.nist.gov/vuln/detail/CVE-2022-24675
  33. https://nvd.nist.gov/vuln/detail/CVE-2021-29923
  34. https://nvd.nist.gov/vuln/detail/CVE-2022-23772
  35. https://nvd.nist.gov/vuln/detail/CVE-2021-33197
  36. https://nvd.nist.gov/vuln/detail/CVE-2022-23773
  37. https://nvd.nist.gov/vuln/detail/CVE-2021-31525
  38. https://nvd.nist.gov/vuln/detail/CVE-2021-33198
  39. https://nvd.nist.gov/vuln/detail/CVE-2021-36221
  40. https://nvd.nist.gov/vuln/detail/CVE-2021-27918
  41. https://nvd.nist.gov/vuln/detail/CVE-2022-30635
  42. https://nvd.nist.gov/vuln/detail/CVE-2022-1962
  43. https://nvd.nist.gov/vuln/detail/CVE-2022-23806
  44. https://nvd.nist.gov/vuln/detail/CVE-2022-30629

Solution

• Update the go version to golang:1.19-alpine and alpine version to alpine:3.17.0 in Dockerfile for zookeeper-exporter. Updating the version will solve all the 44 fixable Vulnerabilities.