Repository navigation
need to fix operator security vulnerabilities #371
Description
The function-mesh-operator has some security vulnerabilities, and we need to fix them, refer to:
https://artifacthub.io/packages/helm/function-mesh/function-mesh-operator?modal=security-report
- CVE-2021-36159. We can fix this by upgrading the operator's base image from alpine 3.10 to alpine 3.12+ (maybe alpine 3.14 would be more appropriate?)
- CVE-2022-27191. Fix the CVE as advised.
- CVE-2020-8565. Fix the CVE as advised.
- CVE-2021-38561. Fix the CVE as advised.
- CVE-2020-9283 fix by [CVE-2020-9283 / CVE-2022-28948] resolve vulnerabilities #478
Reacted by hpvd
Activity
hpvd commentedon Aug 2, 2022
Following link provided above,
today in v0.4:
10 vulnerabilities have been detected in this package's images.
freeznet commentedon Aug 10, 2022
https://catalog.redhat.com/software/containers/streamnative/function-mesh/62d06b34df1077330aa2619d?container-tabs=security
hpvd commentedon Aug 15, 2022
in link above to redhat, the redhat security score of A unfortunately has no real meaningfulness for the total security:
hpvd commentedon Aug 15, 2022
of course its hard to fix all of them...
what do you think of adapting the distroless approach to get rid of software in containers that contains security problems but is actually not needed anyway?
hpvd commentedon Aug 15, 2022
just opened a new issue with some background and sources on the distroless approach:
#448
17 remaining items
hpvd commentedon Oct 18, 2022
Extract:
these 5 updates to the latest versions should solve all found 14 vulnerabilities:
hpvd commentedon Nov 17, 2022
fyi - a CRITICAL vulnerability was newly introduced with the release v0.8
by using an old version of https://github.com/emicklei/go-restful/tags
2.9.5 from May 16, 2019
latest would be v2.16.0 or even 3.10.0
Some others were nicely cleaned up by updating dependencies!
in summary, this leads to a security rating of F (where A is the best)
for details
https://artifacthub.io/packages/helm/function-mesh/function-mesh-operator?modal=security-report
jiangpengcheng commentedon Nov 18, 2022
hm, that looks bad, I will add workflow to scan the vulnerabilities
hpvd commentedon Nov 18, 2022
for further thoughts on this topic see #527 (comment)
hpvd commentedon Nov 18, 2022
looks like they may be introduce by metrics server which has an open issue for this
kubernetes-sigs/metrics-server#1096
or by kube metrics, where a new version was just released (v2.7)
https://github.com/kubernetes/kube-state-metrics/releases
(current rating: A - No vulnerabilities found)
jiangpengcheng commentedon Dec 6, 2022
closing as resolved
hpvd commentedon Dec 22, 2022
perfectly solved:
security rating: A
see
https://artifacthub.io/packages/helm/function-mesh/function-mesh-operator?modal=security-report