dns
dns copied to clipboard
kubernetes
upgrade IPT image version for vuln fixes
Welcome @irLinja!
It looks like this is your first PR to kubernetes/dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.
You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.
You can also check if kubernetes/dns has its own contribution guidelines.
You may want to refer to our testing guide if you run into trouble with your tests not passing.
If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!
Thank you, and welcome to Kubernetes. :smiley:
Hi @irLinja. Thanks for your PR.
I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@irLinja:
In response to this:
/honk
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@irLinja Do you have any information on why this modification can fix the mentioned CVE vulnerability? Thank you.
@zengyuxing007 I ran a vulnerability scanner on the new version and there are no known vulnerabilities as of now.
maybe update to
registry.k8s.io/build-image/distroless-iptables:v0.5.2
Can you link info why upgrading iptables will fix those Vuln issues? Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables
Can you link info why upgrading iptables will fix those Vuln issues? Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables
# skopeo list-tags docker://registry.k8s.io/build-image/distroless-iptables
{
"Repository": "registry.k8s.io/build-image/distroless-iptables",
"Tags": [
"v0.1.0",
"v0.1.1",
"v0.1.2",
"v0.2.0",
"v0.2.1",
"v0.2.10",
"v0.2.2",
"v0.2.3",
"v0.2.4",
"v0.2.5",
"v0.2.6",
"v0.2.7",
"v0.2.8",
"v0.2.9",
"v0.3.0",
"v0.3.1",
"v0.3.2",
"v0.3.3",
"v0.4.0",
"v0.4.1",
"v0.4.2",
"v0.4.3",
"v0.4.4",
"v0.4.5",
"v0.4.6",
"v0.5.0",
"v0.5.1",
"v0.5.2"
]
}
@kl52752
[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.4.1
2024-03-27T19:11:26.860+0800 INFO Vulnerability scanning is enabled
2024-03-27T19:11:26.860+0800 INFO Secret scanning is enabled
2024-03-27T19:11:26.860+0800 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:11:26.860+0800 INFO Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:11:28.494+0800 INFO Detected OS: debian
2024-03-27T19:11:28.494+0800 INFO Detecting Debian vulnerabilities...
2024-03-27T19:11:28.498+0800 INFO Number of language-specific files: 0
registry.k8s.io/build-image/distroless-iptables:v0.4.1 (debian 12.2)
Total: 24 (UNKNOWN: 0, LOW: 16, MEDIUM: 5, HIGH: 3, CRITICAL: 0)
┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils │ CVE-2016-2781 │ LOW │ will_not_fix │ 9.1-1 │ │ coreutils: Non-privileged session can escape to the parent │
│ │ │ │ │ │ │ session in chroot │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2016-2781 │
│ ├──────────────────┤ ├──────────────┤ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2017-18018 │ │ affected │ │ │ coreutils: race condition vulnerability in chown and chgrp │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2017-18018 │
├──────────────┼──────────────────┤ │ ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ iptables │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libc6 │ CVE-2023-6246 │ HIGH │ fixed │ 2.36-9+deb12u3 │ 2.36-9+deb12u4 │ glibc: heap-based buffer overflow in __vsyslog_internal() │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6246 │
│ ├──────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6779 │ │ │ │ │ glibc: off-by-one heap-based buffer overflow in │
│ │ │ │ │ │ │ __vsyslog_internal() │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6779 │
│ ├──────────────────┼──────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6780 │ MEDIUM │ │ │ │ glibc: integer overflow in __vsyslog_internal() │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6780 │
│ ├──────────────────┼──────────┼──────────────┤ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2010-4756 │ LOW │ affected │ │ │ glibc: glob implementation can cause excessive CPU and │
│ │ │ │ │ │ │ memory consumption due to... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2010-4756 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-20796 │ │ │ │ │ glibc: uncontrolled recursion in function │
│ │ │ │ │ │ │ check_dst_limits_calc_pos_1 in posix/regexec.c │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-20796 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010022 │ │ │ │ │ glibc: stack guard protection bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010022 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010023 │ │ │ │ │ glibc: running ldd on malicious ELF leads to code execution │
│ │ │ │ │ │ │ because of... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010023 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010024 │ │ │ │ │ glibc: ASLR bypass using cache of thread stack and heap │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010024 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010025 │ │ │ │ │ glibc: information disclosure of heap addresses of │
│ │ │ │ │ │ │ pthread_created thread │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010025 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-9192 │ │ │ │ │ glibc: uncontrolled recursion in function │
│ │ │ │ │ │ │ check_dst_limits_calc_pos_1 in posix/regexec.c │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-9192 │
├──────────────┼──────────────────┤ │ ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2 │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
├──────────────┤ │ │ │ ├──────────────────┤ │
│ libip6tc2 │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
├──────────────┼──────────────────┤ │ ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4 │ CVE-2020-36325 │ │ │ 2.14-2 │ │ jansson: out-of-bounds read in json_loads() due to a parsing │
│ │ │ │ │ │ │ error │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-36325 │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3 │ CVE-2023-5363 │ HIGH │ fixed │ 3.0.11-1~deb12u1 │ 3.0.11-1~deb12u2 │ openssl: Incorrect cipher key and IV length processing │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-5363 │
│ ├──────────────────┼──────────┼──────────────┤ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-5678 │ MEDIUM │ affected │ │ │ openssl: Generating excessively long X9.42 DH keys or │
│ │ │ │ │ │ │ checking excessively long X9.42... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-5678 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6129 │ │ │ │ │ openssl: POLY1305 MAC implementation corrupts vector │
│ │ │ │ │ │ │ registers on PowerPC │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6129 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6237 │ │ │ │ │ openssl: Excessive time spent checking invalid RSA public │
│ │ │ │ │ │ │ keys │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6237 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2024-0727 │ │ │ │ │ openssl: denial of service via null dereference │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-0727 │
│ ├──────────────────┼──────────┤ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2007-6755 │ LOW │ │ │ │ Dual_EC_DRBG: weak pseudo random number generator │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2007-6755 │
│ ├──────────────────┤ │ │ ├──────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2010-0928 │ │ │ │ │ openssl: RSA authentication weakness │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2010-0928 │
├──────────────┼──────────────────┤ │ ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘
thanks, can you also run
trivy imagefor iptables v0.5.2 image?
HIGH: 0, CRITICAL: 0
[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.5.2
2024-03-27T19:58:42.924+0800 INFO Vulnerability scanning is enabled
2024-03-27T19:58:42.924+0800 INFO Secret scanning is enabled
2024-03-27T19:58:42.924+0800 INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:58:42.924+0800 INFO Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:58:44.150+0800 INFO Detected OS: debian
2024-03-27T19:58:44.150+0800 INFO Detecting Debian vulnerabilities...
2024-03-27T19:58:44.152+0800 INFO Number of language-specific files: 0
registry.k8s.io/build-image/distroless-iptables:v0.5.2 (debian 12.5)
Total: 20 (UNKNOWN: 0, LOW: 16, MEDIUM: 4, HIGH: 0, CRITICAL: 0)
┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils │ CVE-2016-2781 │ LOW │ will_not_fix │ 9.1-1 │ │ coreutils: Non-privileged session can escape to the parent │
│ │ │ │ │ │ │ session in chroot │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2016-2781 │
│ ├──────────────────┤ ├──────────────┤ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2017-18018 │ │ affected │ │ │ coreutils: race condition vulnerability in chown and chgrp │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2017-18018 │
├──────────────┼──────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ iptables │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
├──────────────┼──────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6 │ CVE-2010-4756 │ │ │ 2.36-9+deb12u4 │ │ glibc: glob implementation can cause excessive CPU and │
│ │ │ │ │ │ │ memory consumption due to... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2010-4756 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2018-20796 │ │ │ │ │ glibc: uncontrolled recursion in function │
│ │ │ │ │ │ │ check_dst_limits_calc_pos_1 in posix/regexec.c │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-20796 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010022 │ │ │ │ │ glibc: stack guard protection bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010022 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010023 │ │ │ │ │ glibc: running ldd on malicious ELF leads to code execution │
│ │ │ │ │ │ │ because of... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010023 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010024 │ │ │ │ │ glibc: ASLR bypass using cache of thread stack and heap │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010024 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-1010025 │ │ │ │ │ glibc: information disclosure of heap addresses of │
│ │ │ │ │ │ │ pthread_created thread │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1010025 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-9192 │ │ │ │ │ glibc: uncontrolled recursion in function │
│ │ │ │ │ │ │ check_dst_limits_calc_pos_1 in posix/regexec.c │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-9192 │
├──────────────┼──────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2 │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
├──────────────┤ │ │ │ ├───────────────┤ │
│ libip6tc2 │ │ │ │ │ │ │
│ │ │ │ │ │ │ │
├──────────────┼──────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4 │ CVE-2020-36325 │ │ │ 2.14-2 │ │ jansson: out-of-bounds read in json_loads() due to a parsing │
│ │ │ │ │ │ │ error │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-36325 │
├──────────────┼──────────────────┼──────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3 │ CVE-2023-5678 │ MEDIUM │ │ 3.0.11-1~deb12u2 │ │ openssl: Generating excessively long X9.42 DH keys or │
│ │ │ │ │ │ │ checking excessively long X9.42... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-5678 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6129 │ │ │ │ │ openssl: POLY1305 MAC implementation corrupts vector │
│ │ │ │ │ │ │ registers on PowerPC │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6129 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-6237 │ │ │ │ │ openssl: Excessive time spent checking invalid RSA public │
│ │ │ │ │ │ │ keys │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-6237 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2024-0727 │ │ │ │ │ openssl: denial of service via null dereference │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-0727 │
│ ├──────────────────┼──────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2007-6755 │ LOW │ │ │ │ Dual_EC_DRBG: weak pseudo random number generator │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2007-6755 │
│ ├──────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2010-0928 │ │ │ │ │ openssl: RSA authentication weakness │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2010-0928 │
├──────────────┼──────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663 │ │ │ 1.8.9-2 │ │ iptables: --syn flag bypass │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2012-2663 │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: irLinja, kl52752
The full list of commands accepted by this bot can be found here.
The pull request process is described here
Needs approval from an approver in each of these files:
- ~~OWNERS~~ [kl52752]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment