open-policy-agent / kube-mgmt

Sidecar for managing OPA instances in Kubernetes.
Apache License 2.0
238 stars 106 forks source link

Fixing CVEs CVE-2023-39325, CVE-2023-3978, CVE-2023-44487 #241

Closed saranyareddy24 closed 11 months ago

saranyareddy24 commented 11 months ago

Fix #240

After change ran trivy scan to verify. root@myvm:~# trivy image localhost:5000/openpolicyagent_kube-mgmt:8.5.3-2-g9fecc199-dirty 2023-11-21T06:39:40.196Z INFO Vulnerability scanning is enabled 2023-11-21T06:39:40.196Z INFO Secret scanning is enabled 2023-11-21T06:39:40.196Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning 2023-11-21T06:39:40.196Z INFO Please see also https://aquasecurity.github.io/trivy/v0.44/docs/scanner/secret/#recommendation for faster secret detection 2023-11-21T06:39:40.628Z INFO Detected OS: alpine 2023-11-21T06:39:40.628Z INFO Detecting Alpine vulnerabilities... 2023-11-21T06:39:40.630Z INFO Number of language-specific files: 1 2023-11-21T06:39:40.630Z INFO Detecting gobinary vulnerabilities...

localhost:5000/openpolicyagent_kube-mgmt:8.5.3-2-g9fecc199-dirty (alpine 3.16.7)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)

┌──────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├──────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────┤ │ libcrypto1.1 │ CVE-2023-5678 │ HIGH │ fixed │ 1.1.1v-r0 │ 1.1.1w-r1 │ openssl: Generating excessively long X9.42 DH keys or │ │ │ │ │ │ │ │ checking excessively long X9.42... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-5678 │ ├──────────────┤ │ │ │ │ │ │ │ libssl1.1 │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └──────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘