redhat-cop / group-sync-operator

Synchronizes groups from external providers into OpenShift
Apache License 2.0
110 stars 60 forks source link

Multiple vulnerabilities in dependency kube-rbac-proxy #281

Open flippyboy opened 9 months ago

flippyboy commented 9 months ago

The container image for kube-rbac-proxy that is included in this operator is over two years old and contains multiple vulnerabilities. Many of them are ranked as high severity. This is being flagged by our internal security tools. See the report on Quay for specifics: https://quay.io/repository/redhat-cop/kube-rbac-proxy/manifest/sha256:8ac4596bae29a6956d9e3a6688e38fc82ea0dbab877ab554096d54f80f0252a3?tab=vulnerabilities&fixable=true

Could you either make sure that the referenced image is updated or utilize another image that is being actively maintained?