pipelines icon indicating copy to clipboard operation
pipelines copied to clipboard

Update the controller python image version 3.8.13

Open lukeogg opened this issue 3 years ago • 2 comments

Description of your changes:

Update the controller python image version 3.8.13.

  • This resolved multiple CRITICAL CVEs registering against this image.
  • Controller runs fine on slim image.
  • Explicitly set version to bullseye and full python version number for stability.

This fixes many Critical CVEs including:

NAME VULNERABILITY SEVERITY
curl CVE-2022-32207 Critical
curl CVE-2021-22945 Critical
dpkg CVE-2022-1664 Critical
dpkg-dev CVE-2022-1664 Critical
libaom0 CVE-2021-30474 Critical
libaom0 CVE-2021-30475 Critical
libaom0 CVE-2021-30473 Critical
libbluetooth-dev CVE-2021-43400 Critical
libbluetooth3 CVE-2021-43400 Critical
libc-bin CVE-2022-23219 Critical
libc-bin CVE-2022-23218 Critical
libc-bin CVE-2021-33574 Critical
libc-dev-bin CVE-2021-33574 Critical
libc-dev-bin CVE-2022-23219 Critical
libc-dev-bin CVE-2022-23218 Critical
libc6 CVE-2021-33574 Critical
libc6 CVE-2022-23219 Critical
libc6 CVE-2022-23218 Critical
libc6-dev CVE-2021-33574 Critical
libc6-dev CVE-2022-23219 Critical
libc6-dev CVE-2022-23218 Critical
libcurl3-gnutls CVE-2022-32207 Critical
libcurl3-gnutls CVE-2021-22945 Critical
libcurl4 CVE-2022-32207 Critical
libcurl4 CVE-2021-22945 Critical
libcurl4-openssl-dev CVE-2021-22945 Critical
libcurl4-openssl-dev CVE-2022-32207 Critical
libde265-0 CVE-2022-1253 Critical
libdpkg-perl CVE-2022-1664 Critical
libexpat1 CVE-2022-23852 Critical
libexpat1 CVE-2022-25315 Critical
libexpat1 CVE-2022-25235 Critical
libexpat1 CVE-2022-25236 Critical
libexpat1 CVE-2022-23990 Critical
libexpat1 CVE-2022-22824 Critical
libexpat1 CVE-2022-22822 Critical
libexpat1 CVE-2022-22823 Critical
libexpat1-dev CVE-2022-22822 Critical
libexpat1-dev CVE-2022-25315 Critical
libexpat1-dev CVE-2022-25236 Critical
libexpat1-dev CVE-2022-23990 Critical
libexpat1-dev CVE-2022-22823 Critical
libexpat1-dev CVE-2022-22824 Critical
libexpat1-dev CVE-2022-25235 Critical
libexpat1-dev CVE-2022-23852 Critical
libfreetype-dev CVE-2022-27404 Critical
libfreetype6 CVE-2022-27404 Critical
libfreetype6-dev CVE-2022-27404 Critical
libldap-2.4-2 CVE-2022-29155 Critical
libmariadb-dev CVE-2022-32091 Critical
libmariadb-dev CVE-2022-32081 Critical
libmariadb-dev-compat CVE-2022-32081 Critical
libmariadb-dev-compat CVE-2022-32091 Critical
libmariadb3 CVE-2022-32081 Critical
libmariadb3 CVE-2022-32091 Critical
libpython3.9-minimal CVE-2021-29921 Critical
libpython3.9-minimal CVE-2015-20107 Critical
libpython3.9-stdlib CVE-2021-29921 Critical
libpython3.9-stdlib CVE-2015-20107 Critical
libssl-dev CVE-2022-2068 Critical
libssl-dev CVE-2022-1292 Critical
libssl1.1 CVE-2022-1292 Critical
libssl1.1 CVE-2022-2068 Critical
mariadb-common CVE-2022-32091 Critical
mariadb-common CVE-2022-32081 Critical
openssl CVE-2022-2068 Critical
openssl CVE-2022-1292 Critical
python3.9 CVE-2015-20107 Critical
python3.9 CVE-2021-29921 Critical
python3.9-minimal CVE-2015-20107 Critical
python3.9-minimal CVE-2021-29921 Critical

lukeogg avatar Aug 11 '22 01:08 lukeogg

Hi @lukeogg. Thanks for your PR.

I'm waiting for a kubeflow member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

google-oss-prow[bot] avatar Aug 11 '22 01:08 google-oss-prow[bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Once this PR has been reviewed and has the lgtm label, please assign zijianjoy for approval by writing /assign @zijianjoy in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

google-oss-prow[bot] avatar Aug 11 '22 01:08 google-oss-prow[bot]