Open aaronfern opened 1 month ago
Few more new CVE's
trivy image --severity LOW,MEDIUM,HIGH,CRITICAL --ignore-unfixed --exit-code 3 --exit-on-eol 7 --scanners vuln registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.19
Total: 8 (LOW: 0, MEDIUM: 2, HIGH: 6, CRITICAL: 0)
┌────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libgnutls30 │ CVE-2024-28834 │ MEDIUM │ fixed │ 3.7.9-2+deb12u2 │ 3.7.9-2+deb12u3 │ gnutls: vulnerable to Minerva side-channel information leak │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-28834 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2024-28835 │ │ │ │ │ gnutls: potential crash during chain building/verification │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-28835 │
├────────────────┼────────────────┼──────────┤ ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libsystemd-dev │ CVE-2023-50387 │ HIGH │ │ 252.22-1~deb12u1 │ 252.23-1~deb12u1 │ bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50387 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-50868 │ │ │ │ │ bind9: Preparing an NSEC3 closest encloser proof can exhaust │
│ │ │ │ │ │ │ CPU resources │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50868 │
├────────────────┼────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ libsystemd0 │ CVE-2023-50387 │ │ │ │ │ bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50387 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-50868 │ │ │ │ │ bind9: Preparing an NSEC3 closest encloser proof can exhaust │
│ │ │ │ │ │ │ CPU resources │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50868 │
├────────────────┼────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ libudev1 │ CVE-2023-50387 │ │ │ │ │ bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50387 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-50868 │ │ │ │ │ bind9: Preparing an NSEC3 closest encloser proof can exhaust │
│ │ │ │ │ │ │ CPU resources │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-50868 │
└────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘
Our scans show additional CVEs to the ones reported above. Please find the complete list(including some of the ones mentioned earlier) of CVEs reported against this image.
wondering someone would like to submit CL to update golang, go mod etc. to resolve those CVEs?
wondering someone would like to submit CL to update golang, go mod etc. to resolve those CVEs?
This is covered by weekly deps update. It is usually auto generated on Fridays.
@hakman does dep-bot update Go version as well? or just Go modules/pkgs?
Looks like the dep-bot does not update golang version: https://github.com/kubernetes/node-problem-detector/pull/935
Can we please get an update on when to expect a new release with these CVEs fixed?
Bump! It would be great to get a 0.8.20 release to address these CVEs in a tagged release
Vulnerability scan shown a CVE for
NPD:v0.8.19
This issue is to log this and ask when this would be fixed