Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerabilities found for persistenceagent:2.0.5 #126

Open
ckfbot opened this issue Oct 16, 2024 · 1 comment
Open

Vulnerabilities found for persistenceagent:2.0.5 #126

ckfbot opened this issue Oct 16, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@ckfbot
Copy link
Collaborator

ckfbot commented Oct 16, 2024

Vulnerabilities found for persistenceagent:2.0.5


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.56/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


charmedkubeflow/persistenceagent:2.0.5-8feef4e (ubuntu 22.04)
=============================================================
Total: 0 (HIGH: 0, CRITICAL: 0)


usr/bin/go-licenses (gobinary)
==============================
Total: 7 (HIGH: 6, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │         Installed Version          │           Fixed Version           │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2022-27191 │ HIGH     │ fixed  │ v0.0.0-20220112180741-5e0467b6c7ce │ 0.0.0-20220314234659-1baeb1ce4c0b │ golang: crash in a golang.org/x/crypto/ssh server            │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-27191                   │
├─────────────────────┼────────────────┤          │        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2022-27664 │          │        │ v0.0.0-20211112202133-69e39bad7dc2 │ 0.0.0-20220906165146-f3363e06e74c │ golang: net/http: handle server errors after sending GOAWAY  │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-27664                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2022-41723 │          │        │                                    │ 0.7.0                             │ golang.org/x/net/http2: avoid quadratic complexity in HPACK  │
│                     │                │          │        │                                    │                                   │ decoding                                                     │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2022-41723                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2023-39325 │          │        │                                    │ 0.17.0                            │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                     │                │          │        │                                    │                                   │ excessive work (CVE-2023-44487)                              │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
├─────────────────────┼────────────────┼──────────┤        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib              │ CVE-2024-24790 │ CRITICAL │        │ 1.20.14                            │ 1.21.11, 1.22.4                   │ golang: net/netip: Unexpected behavior from Is methods for   │
│                     │                │          │        │                                    │                                   │ IPv4-mapped IPv6 addresses                                   │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│                     ├────────────────┼──────────┤        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2023-45288 │ HIGH     │        │                                    │ 1.21.9, 1.22.2                    │ golang: net/http, x/net/http2: unlimited number of           │
│                     │                │          │        │                                    │                                   │ CONTINUATION frames causes DoS                               │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-45288                   │
│                     ├────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-34156 │          │        │                                    │ 1.22.7, 1.23.1                    │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                     │                │          │        │                                    │                                   │ which contains deeply nested structures...                   │
│                     │                │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
└─────────────────────┴────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────────────────────────┴──────────────────────────────────────────────────────────────┘

usr/bin/persistence_agent (gobinary)
====================================
Total: 11 (HIGH: 10, CRITICAL: 1)

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │              Fixed Version               │                            Title                             │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2023-39325      │ HIGH     │ fixed  │ v0.10.0           │ 0.17.0                                   │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                        │                     │          │        │                   │                                          │ excessive work (CVE-2023-44487)                              │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
├────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-m425-mq94-257g │          │        │ v1.44.0           │ 1.56.3, 1.57.1, 1.58.3                   │ gRPC-Go HTTP/2 Rapid Reset vulnerability                     │
│                        │                     │          │        │                   │                                          │ https://github.com/advisories/GHSA-m425-mq94-257g            │
├────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ k8s.io/kubernetes      │ CVE-2019-11253      │          │        │ v1.11.1           │ 1.13.12, 1.14.8, 1.15.5, 1.16.2          │ kubernetes: YAML parsing vulnerable to "Billion Laughs"      │
│                        │                     │          │        │                   │                                          │ attack, allowing for remote denial...                        │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2019-11253                   │
│                        ├─────────────────────┤          │        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2020-8558       │          │        │                   │ 1.18.4, 1.17.7, 1.16.11                  │ kubernetes: node localhost services reachable via martian    │
│                        │                     │          │        │                   │                                          │ packets                                                      │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2020-8558                    │
│                        ├─────────────────────┤          │        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2021-25741      │          │        │                   │ 1.19.15, 1.20.11, 1.21.5, 1.22.2         │ kubernetes: Symlink exchange can allow host filesystem       │
│                        │                     │          │        │                   │                                          │ access                                                       │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2021-25741                   │
│                        ├─────────────────────┤          │        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2023-3676       │          │        │                   │ 1.28.1, 1.27.5, 1.26.8, 1.25.13, 1.24.17 │ kubernetes: Insufficient input sanitization on Windows nodes │
│                        │                     │          │        │                   │                                          │ leads to privilege escalation                                │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-3676                    │
│                        ├─────────────────────┤          │        │                   │                                          ├──────────────────────────────────────────────────────────────┤
│                        │ CVE-2023-3955       │          │        │                   │                                          │ kubernetes: Insufficient input sanitization on Windows nodes │
│                        │                     │          │        │                   │                                          │ leads to privilege escalation                                │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-3955                    │
│                        ├─────────────────────┤          │        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2023-5528       │          │        │                   │ 1.28.4, 1.27.8, 1.26.11, 1.25.16         │ kubernetes: Insufficient input sanitization in in-tree       │
│                        │                     │          │        │                   │                                          │ storage plugin leads to privilege escalation...              │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-5528                    │
├────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                 │ CVE-2024-24790      │ CRITICAL │        │ 1.20.14           │ 1.21.11, 1.22.4                          │ golang: net/netip: Unexpected behavior from Is methods for   │
│                        │                     │          │        │                   │                                          │ IPv4-mapped IPv6 addresses                                   │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│                        ├─────────────────────┼──────────┤        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2023-45288      │ HIGH     │        │                   │ 1.21.9, 1.22.2                           │ golang: net/http, x/net/http2: unlimited number of           │
│                        │                     │          │        │                   │                                          │ CONTINUATION frames causes DoS                               │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-45288                   │
│                        ├─────────────────────┤          │        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                        │ CVE-2024-34156      │          │        │                   │ 1.22.7, 1.23.1                           │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                        │                     │          │        │                   │                                          │ which contains deeply nested structures...                   │
│                        │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

Details: https://github.com/canonical/pipelines-rocks/actions/runs/11902725190

@ckfbot ckfbot added the bug Something isn't working label Oct 16, 2024
Copy link

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/KF-6482.

This message was autogenerated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant