k8s-wait-for
k8s-wait-for copied to clipboard
groundnuty
Multiple CVEs reported by Aqua Scan
Aqua Scan reports tons of CVEs in cURL binary:
Since we use this image in production environment, every CVE causes critical security incident (via automated job periodically checking all clusters) which is a pain itself. Easy fix would be to bump cURL version.
There is already a pull request https://github.com/groundnuty/k8s-wait-for/pull/55/commits/f9c3f440058355543a9c17bf3bef86aedb663f53 that bumps curl to the version presented on your image.
This week I will get around and release a new version.
Thx for sharing a screenshot and it's nice someone is using it in production :-)
Good to hear that! Waiting for the release. I can also suggest using https://github.com/aquasecurity/trivy since it is the same engine as Aqua Scan except open-source.
I know trivia and aqua - it's a good idea. I see there are github actions for trivy, tho first I will need to move travis pipeline to github actions (what should be done anyway) it's a bit more work to stay tuned!
@kgusarov added trivy scan as part of the release d36aeab and dedicated daily scan 972c9cf Next release will have all the sec fixes.
@kgusarov new release v1.7 is here and all things reported by trivi has been fixed