The component of KubeEdge is currently using has a security vulnerability - Githubissues

kubeedge / kubeedge

Kubernetes Native Edge Computing Framework (project under CNCF)

https://kubeedge.io

Apache License 2.0

6.55k stars 1.69k forks source link

The component of KubeEdge is currently using has a security vulnerability #5701

Open My-pleasure opened 4 days ago

My-pleasure commented 4 days ago

What happened:

beego v1.12.12 has four security vulnerabilities:
- CVE-2021-30080: https://github.com/beego/beego/commit/d5df5e470d0a8ed291930ae802fd7e6b95226519
- CVE-2022-31836: https://github.com/beego/beego/issues/4961, https://github.com/advisories/GHSA-95f9-94vc-665h
- CVE-2021-27116: https://github.com/beego/beego/issues/4484
- CVE-2021-27117: https://github.com/beego/beego/issues/4484
runc v1.1.7 has one security vulnerability:
- CVE-2024-21626: https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv, https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf, https://github.com/opencontainers/runc/releases/tag/v1.1.12

What you expected to happen:

beego version is at least updated to 2.0.4
runc version is at least updated to v1.1.12

Environment:

edgecore version (e.g. edgecore --version): v1.17

Shelley-BaoYue commented 4 days ago

We have upgraded beego version to v2.1.6 in PR https://github.com/kubeedge/kubeedge/pull/5261. Would you like help us to upgrade the runc version?