Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVEs for v1.2.0 #651

Closed
chewong opened this issue May 7, 2021 · 5 comments · Fixed by #653 or kubernetes-sigs/azuredisk-csi-driver#838
Closed

CVEs for v1.2.0 #651

chewong opened this issue May 7, 2021 · 5 comments · Fixed by #653 or kubernetes-sigs/azuredisk-csi-driver#838

Comments

@chewong
Copy link
Member

chewong commented May 7, 2021 

~ » trivy --ignore-unfixed mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.2.0                                                                         130 ↵ chuwon@WXEXVM
2021-05-07T09:55:02.988-0700	INFO	Detecting Debian vulnerabilities...
2021-05-07T09:55:03.027-0700	INFO	Trivy skips scanning programming language libraries because no supported file was detected

mcr.microsoft.com/oss/kubernetes-csi/azurefile-csi:v1.2.0 (debian 10.5)
=======================================================================
Total: 7 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 2, CRITICAL: 0)

+---------------+------------------+----------+-------------------+----------------------+---------------------------------------+
|    LIBRARY    | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |    FIXED VERSION     |                 TITLE                 |
+---------------+------------------+----------+-------------------+----------------------+---------------------------------------+
| apt           | CVE-2020-27350   | MEDIUM   | 1.8.2.1           | 1.8.2.2              | apt: integer overflows and underflows |
|               |                  |          |                   |                      | while parsing .deb packages           |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2020-27350 |
+---------------+                  +          +                   +                      +                                       +
| libapt-pkg5.0 |                  |          |                   |                      |                                       |
|               |                  |          |                   |                      |                                       |
|               |                  |          |                   |                      |                                       |
+---------------+------------------+----------+-------------------+----------------------+---------------------------------------+
| libp11-kit0   | CVE-2020-29361   | HIGH     | 0.23.15-2         | 0.23.15-2+deb10u1    | p11-kit: integer overflow when        |
|               |                  |          |                   |                      | allocating memory for arrays          |
|               |                  |          |                   |                      | or attributes and object...           |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2020-29361 |
+               +------------------+          +                   +                      +---------------------------------------+
|               | CVE-2020-29363   |          |                   |                      | p11-kit: out-of-bounds write in       |
|               |                  |          |                   |                      | p11_rpc_buffer_get_byte_array_value   |
|               |                  |          |                   |                      | function in rpc-message.c             |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2020-29363 |
+               +------------------+----------+                   +                      +---------------------------------------+
|               | CVE-2020-29362   | MEDIUM   |                   |                      | p11-kit: out-of-bounds read in        |
|               |                  |          |                   |                      | p11_rpc_buffer_get_byte_array         |
|               |                  |          |                   |                      | function in rpc-message.c             |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2020-29362 |
+---------------+------------------+          +-------------------+----------------------+---------------------------------------+
| libzstd1      | CVE-2021-24031   |          | 1.3.8+dfsg-3      | 1.3.8+dfsg-3+deb10u1 | zstd: adds read permissions           |
|               |                  |          |                   |                      | to files while being                  |
|               |                  |          |                   |                      | compressed or uncompressed            |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2021-24031 |
+               +------------------+          +                   +----------------------+---------------------------------------+
|               | CVE-2021-24032   |          |                   | 1.3.8+dfsg-3+deb10u2 | zstd: Race condition                  |
|               |                  |          |                   |                      | allows attacker to access             |
|               |                  |          |                   |                      | world-readable destination file       |
|               |                  |          |                   |                      | -->avd.aquasec.com/nvd/cve-2021-24032 |
+---------------+------------------+----------+-------------------+----------------------+---------------------------------------+
@andyzhangx
Copy link
Member

@chewong thanks, do you have experience how to fix such issue? I think some packages in this Dockerfile should be replaced: https://github.com/kubernetes-sigs/azurefile-csi-driver/blob/master/pkg/azurefileplugin/Dockerfile
cc @andyliuliming

@andyzhangx
Copy link
Member

andyzhangx commented May 8, 2021 •
edited
Loading

looks like we need a more secure debian base image, now it's k8s.gcr.io/build-image/debian-base-${ARCH}:v2.1.3

@sozercan
Copy link
Contributor

yes, base image needs to be updated to buster-v1.6.0 and later

@chewong
Copy link
Member Author

chewong commented May 10, 2021 •
edited
Loading

You can also manually patch individual package with RUN clean-install <package name> in the Dockerfile.

@andyzhangx andyzhangx mentioned this issue May 11, 2021
Merged
4 tasks
@andyzhangx
Copy link
Member

yes, base image needs to be updated to buster-v1.6.0 and later

@sozercan thanks, buster-v1.6.0 works, only one issue found, I think v0.21.0 is equal to k8s v1.21.0 client, that should be wrong version check.

# trivy --ignore-unfixed mcr.microsoft.com/k8s/csi/azurefile-csi:latest
2021-05-11T08:13:45.760Z        INFO    Detecting Debian vulnerabilities...
2021-05-11T08:13:45.773Z        INFO    Detecting gobinary vulnerabilities...

mcr.microsoft.com/k8s/csi/azurefile-csi:latest (debian 10.9)
============================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


azurefileplugin
===============
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

+------------------+------------------+----------+-------------------+-----------------------+---------------------------------------+
|     LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |     FIXED VERSION     |                 TITLE                 |
+------------------+------------------+----------+-------------------+-----------------------+---------------------------------------+
| k8s.io/client-go | CVE-2019-11250   | MEDIUM   | v0.21.0           | 1.15.4, 1.16.1-beta.0 | kubernetes: Bearer tokens             |
|                  |                  |          |                   |                       | written to logs at high               |
|                  |                  |          |                   |                       | verbosity levels (>= 7)...            |
|                  |                  |          |                   |                       | -->avd.aquasec.com/nvd/cve-2019-11250 |
+------------------+------------------+----------+-------------------+-----------------------+---------------------------------------+

This was referenced May 11, 2021
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
3 participants
@sozercan @andyzhangx @chewong