search

h2oai / wave

Realtime Web Apps and Dashboards for Python and R
https://wave.h2o.ai
Apache License 2.0
3.9k stars 323 forks source link

Resolve Vulnerabilities in Wave Tour Image #2296

Closed codyharris-h2o-ai closed 2 months ago

codyharris-h2o-ai commented 3 months ago

Hello! As part of our ongoing to ensure the security of our products, one or more vulnerabilties requiring redmediation have been identified.

The following vulnerabilities were scanned and found by using ECR. ECR scans are used in conjunction with Prisma scans to ensure we meet a high standard for software security. We have suggestions on tooling to help improve the remediation process, following the vulnerability table below. Note that we disregard the severity levels assigned by various tools and operate soley on CVSS to severity mapping in line with NIST guidelines.

Vulnerability Severity Image Package Description
CVE-2023-28531 critical 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 openssh:9.2p1 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earlies[...]
CVE-2020-29652 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/crypto:v0.0.0-20201012173705-84dcc777aaee A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remo[...]
CVE-2021-33194 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/net:v0.0.0-20200822124328-c89045814202 golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via cra[...]
CVE-2021-3610 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 imagemagick:6.9.11.60+dfsg A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/[...]
CVE-2021-43565 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/crypto:v0.0.0-20201012173705-84dcc777aaee The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH serv[...]
CVE-2022-27191 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/crypto:v0.0.0-20201012173705-84dcc777aaee The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in cert[...]
CVE-2022-27664 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/net:v0.0.0-20200822124328-c89045814202 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection c[...]
CVE-2022-41723 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/net:v0.0.0-20200822124328-c89045814202 A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of [...]
CVE-2023-27103 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 libde265:1.0.11 Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc[...]
CVE-2023-39325 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/net:v0.0.0-20200822124328-c89045814202 A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consump[...]
CVE-2023-43887 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 libde265:1.0.11 Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the[...]
CVE-2023-44487 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 golang.org/x/net nghttp2:v0.0.0-20200822124328-c89045814202 1.52.0 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams[...]
CVE-2023-47038 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 perl:5.36.0 A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an a[...]
CVE-2023-4863 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 opencv-python:4.5.5.64 Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform [...]
CVE-2023-49465 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 libde265:1.0.11 Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction fun[...]
CVE-2023-49467 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 libde265:1.0.11 Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive_combined_bipredictive_merging_cand[...]
CVE-2023-49468 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 libde265:1.0.11 Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read_coding_unit function at slice.cc.
CVE-2023-50471 high 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 cjson:1.7.15 cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.

grep: (standard input): binary file matches | CVE-2023-52425 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | expat:2.5.0 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case o[...] | | CVE-2023-6246 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | glibc:2.36 | A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the s[...] | | CVE-2023-6569 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | h2o:3.44.0.3 | External Control of File Name or Path in h2oai/h2o-3 | | CVE-2023-6779 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | glibc:2.36 | An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is cal[...] | | CVE-2024-0553 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | gnutls28:3.7.9 | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the re[...] | | CVE-2024-0565 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | linux:6.1.55 | An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-compo[...] | | CVE-2024-0567 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | gnutls28:3.7.9 | A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. Thi[...] | | CVE-2024-0985 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | postgresql-15:15.5 | Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL fu[...] | | CVE-2024-21634 | high | 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:1.0.0 | software.amazon.ion:ion-java:1.0.2 | Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exist[...] |

To resolve this, we recommend the following approach:

  1. Install trivy (https://aquasecurity.github.io/trivy)
  2. Scan the current version of the image using a command like trivy image --scanners vuln --severity CRITICAL,HIGH --timeout 60m [...image address...]
  3. Validate that the CVEs are detected using trivy. The provided scans were taken using a different scanner (ECR), so the first step should be to validate that trivy can see them as well.
  4. Iterate to resolve the vulnerabilities. trivy enables you to scan the image without pushing them, so it should help in finding the resolution
  5. Test and publish the fix version, and let us know where we can find the fixed image(s) so we can validate the fixes on our side as well.
mturoci commented 2 months ago

Closed by https://github.com/h2oai/wave/pull/2302