[BUG] Vulnerability in docker v27.03 used in k3d - Githubissues

k3d-io / k3d

Little helper to run CNCF's k3s in Docker

https://k3d.io/

MIT License

5.48k stars 462 forks source link

[BUG] Vulnerability in docker v27.03 used in k3d #1482

Closed louisnow closed 1 month ago

louisnow commented 3 months ago

What did you do

How was the cluster created?
- Installed k3d using the install script command and ran a vulnerability scanner on it.
- It reported a critical vulnerability in docker v27.0.3 which is what the project uses.
https://avd.aquasec.com/nvd/2024/cve-2024-41110/

It's been fixed in v27.1.1

What did you expect to happen

Can we evaluate if we can upgrade the the docker version?

Screenshots or terminal output

If applicable, add screenshots or terminal output (code block) to help explain your problem.

Screenshot 2024-08-06 at 4 08 51 PM

Which OS & Architecture

alpine:latest

Which version of `k3d`

5.7.3

Which version of docker

The k3d binary uses the older library v27.0.3 which we likely need to upgrade