Closed pandoscas closed 8 months ago
@pandoscas I have updated zookeeper to 3.8.3 for vulnerabilities remediation.
Updated files: docker/zu/build.gradle.kts
docker/Dockerfile (updated base img version of zk)
Looks like these two are only files to be modified to make it 3.8.3 I can see good amount of vulnerabilities have been removed.
Yes from what I could tell even on other repositories that would close not only the CVEs I referred but also a good amount of other vulnerabilities.
@subhranil05 there is one issue with scaling in this image, https://issues.apache.org/jira/browse/ZOOKEEPER-4530 Due to that we are not upgrading
Nice find! I can see if the CVEs were fixed under 3.7.
@anishakj thanks for pointing it out, will check with 3.7.2
Already checked the vulnerabilities with 3.7.2, no CRITICAL were found there. vulnerability_zookeeper.json
I can commit right away the change if 3.7 is ok.
I can commit right away the change if 3.7 is ok.
sure, please
@pandoscas what is the status with 3.7.2 ? Is it worki working fine with scale in ? I still din't see any commits
@pandoscas what is the status with 3.7.2 ? Is it worki working fine with scale in ? I still din't see any commits
PR is here: https://github.com/pravega/zookeeper-operator/pull/586.
@pandoscas what is the status with 3.7.2 ? Is it worki working fine with scale in ? I still din't see any commits
PR is here: #586.
@pandoscas Could you please update the README to 3.7.2
One question @anishakj how can I request the creation of a 0.2.16
version? Is it an issue that needs to be opened?
One question @anishakj how can I request the creation of a
0.2.16
version? Is it an issue that needs to be opened?
u can create build by using make build-zk-image
till the new release is made
Hi @anishakj, do you know the approximate timeline for the 0.2.16 release? Something like spring 2024? or are there plans to do it earlier (to release the CVE fixes, etc.)?
Description
While running trivy to look for vulnerabilities in the latest 0.2.15 images, the report returned multiple CRITICAL CVEs in the zookeeper image that have been resolved in the latest stable 3.8.3.
I have attatched to this issue the report extracted from trivy, but the CRITICAL CVEs found are: CVE-2023-38545 CVE-2021-32292 CVE-2022-3515 CVE-2022-47629 CVE-2022-1586 CVE-2022-1587 CVE-2021-46848 CVE-2022-37434 CVE-2023-44981
vulnerability_zookeeper_operator_upgrade.json
Importance
must-have
Location
Zookeeper image
Suggestions for an improvement
Bump the zookeeper docker image to version 3.8.3, which is the latest stable version.