oracle / graal

GraalVM compiles Java applications into native executables that start instantly, scale fast, and use fewer compute resources 🚀

https://www.graalvm.org

Other

20.25k stars 1.62k forks source link

VULNERABILITY - RHSA-2021:4374 CVSS Score v3: 9.1 Docker Image - Graal 21.3.0 #4103

Closed debu999 closed 2 years ago

debu999 commented 2 years ago

Getting vulnerability - Need fix. Scan is done via AquaSec for the docker image. RHSA-2021:4374 RHSA-2021:4358 RHSA-2021:4464 RHSA-2021:4595 RHSA-2021:4587 RHSA-2021:4382 RHSA-2021:4059 RHSA-2021:4409 RHSA-2021:4373 RHSA-2021:4424 RHSA-2021:4060 RHSA-2021:4451 RHSA-2021:4451 RHSA-2021:4364 RHSA-2021:4387 RHSA-2021:4386 RHSA-2021:4385 RHSA-2021:4511 RHSA-2021:4489 RHSA-2021:4408 RHSA-2021:4513 Not allowed to procure if there are vulnerabilities in the image. Can this be fixed in new builds of graal VM

rodrigar-mx commented 2 years ago

Hi @debu999. Thanks for sharing this. Could you please i) share which graalvm version are you evaluating, ii) steps to generate this report (if possible) iii) and elaborate more on this type vulnerability scan.

debu999 commented 2 years ago

@rodrigar-mx Thanks for reaching out. Steps: We are trying to get the image for version 21.3.0 We use aquasec to scan the images. https://www.aquasec.com/

debu999 commented 2 years ago

most of them are for the red-hat linux version. All the issues are now having patches, mostly a upgraded redhat linux will solve all the vulnerabilities.

debu999 commented 2 years ago

More details

rodrigar-mx commented 2 years ago

How are you building building/getting the image for graalvm 21.3.0?

debu999 commented 2 years ago

docker pull ghcr.io/graalvm/graalvm-ce:21.3.0 Once the image is pulled to staging platfomr, AQUASEC scan the image and details are publish if no vulnerabilty it uploads to private container registry else throw error. The one is have listed above are detected during the scan of the image.

rodrigar-mx commented 2 years ago

Thanks @debu999. I have reported this issue internally. An answer will be provided accordingly.

dougxc commented 2 years ago

What files in the GraalVM image are these reports related to?

debu999 commented 2 years ago

More details : Install Aquasec Trivy: https://aquasecurity.github.io/trivy/v0.18.3/installation/ Download the image: docker pull ghcr.io/graalvm/graalvm-ce:latest Run the Scan: trivy image ghcr.io/graalvm/graalvm-ce:latest Attaching the report for reference.

ghcr.io/graalvm/graalvm-ce:latest (oracle 8.4)

Total: 141 (UNKNOWN: 0, LOW: 18, MEDIUM: 73, HIGH: 43, CRITICAL: 7)

Refer to the attachment for details.

Java (jar)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

graalvm-ce-trivy-scan.txt

Vulnerable Library: Screenshot 2021-12-21 at 10 33 19 AM Screenshot 2021-12-21 at 10 35 12 AM

debu999 commented 2 years ago

Release	General Availability Date	redhat-release Errata Date*	Kernel Version
RHEL 8.5	2021-11-09	2021-11-09 RHSA-2021:4356	4.18.0-348

I believe moving to the latest RHEL 8.5 will definitely fix most of the issues . Current image is built with RHEL 8.4 which have the vulnerabilities.

dougxc commented 2 years ago

Tracked internally by GR-35944.

debu999 commented 2 years ago

Looking forward to it...

debu999 commented 2 years ago

Hi Team any thing done in upgrading to latest RHEL version?

debu999 commented 2 years ago

Hi Team, Can we expect a new version of Graal with new Rhel Base immage???

debu999 commented 2 years ago

Any update on this

rodrigar-mx commented 2 years ago

HI @debu999. Still is work in progress. We will notify you as soon as there is any update.

debu999 commented 2 years ago

Graal new version have the fix we can close it now