fix all known trivy scan vulnerabilities

[hookenz]

Since the last go modules update I did was merged, more vulnerabilities have since been reported.

This update, fixes those as well.

Before:

❯ trivy fs .
2022-08-29T09:22:17.963+1200	INFO	Number of language-specific files: 2
2022-08-29T09:22:17.963+1200	INFO	Detecting bundler vulnerabilities...
2022-08-29T09:22:17.963+1200	INFO	Detecting gomod vulnerabilities...

docs/Gemfile.lock (bundler)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬───────────────────┬──────────────────────┬────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Installed Version │    Fixed Version     │                   Title                    │
├─────────┼────────────────┼──────────┼───────────────────┼──────────────────────┼────────────────────────────────────────────┤
│ tzinfo  │ CVE-2022-31163 │ HIGH     │ 1.2.9             │ ~> 0.3.61, >= 1.2.10 │ rubygem-tzinfo: arbitrary code execution   │
│         │                │          │                   │                      │ https://avd.aquasec.com/nvd/cve-2022-31163 │
└─────────┴────────────────┴──────────┴───────────────────┴──────────────────────┴────────────────────────────────────────────┘

go.mod (gomod)

Total: 7 (UNKNOWN: 3, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 1)

┌──────────────────────────────────┬─────────────────────┬──────────┬───────────────────────────────────┬───────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│             Library              │    Vulnerability    │ Severity │         Installed Version         │           Fixed Version           │                            Title                             │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/containerd/containerd │ CVE-2022-31030      │ MEDIUM   │ 1.6.4                             │ v1.5.13, v1.6.6                   │ containerd is an open source container runtime. A bug was    │
│                                  │                     │          │                                   │                                   │ found in...                                                  │
│                                  │                     │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-31030                   │
│                                  ├─────────────────────┼──────────┤                                   │                                   ├──────────────────────────────────────────────────────────────┤
│                                  │ GHSA-5ffw-gxpp-mxpf │ UNKNOWN  │                                   │                                   │ Improper Neutralization of Special Elements used in an OS    │
│                                  │                     │          │                                   │                                   │ Command ('OS Command...                                      │
│                                  │                     │          │                                   │                                   │ https://github.com/advisories/GHSA-5ffw-gxpp-mxpf            │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful   │ CVE-2022-1996       │ CRITICAL │ 2.9.5+incompatible                │ 2.16.0                            │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                  │                     │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful   │ GHSA-r48q-9g5r-8q2h │ UNKNOWN  │ 2.9.5+incompatible                │ 2.16.0                            │ CORS filters that use an AllowedDomains configuration        │
│                                  │                     │          │                                   │                                   │ parameter                                                    │
│                                  │                     │          │                                   │                                   │ can match domains outside the...                             │
│                                  │                     │          │                                   │                                   │ https://github.com/advisories/GHSA-r48q-9g5r-8q2h            │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto              │ CVE-2022-27191      │ HIGH     │ 0.0.0-20210817164053-32db794688a5 │ 0.0.0-20220314234659-1baeb1ce4c0b │ golang: crash in a golang.org/x/crypto/ssh server            │
│                                  │                     │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-27191                   │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto              │ GHSA-8c26-wmh5-6g9v │ UNKNOWN  │ 0.0.0-20210817164053-32db794688a5 │ 0.0.0-20220314234659-1baeb1ce4c0b │ Attackers can cause a crash in SSH servers when the server   │
│                                  │                     │          │                                   │                                   │ has...                                                       │
│                                  │                     │          │                                   │                                   │ https://github.com/advisories/GHSA-8c26-wmh5-6g9v            │
├──────────────────────────────────┼─────────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/sys                 │ CVE-2022-29526      │ MEDIUM   │ 0.0.0-20220319134239-a9b59b0215f8 │ 0.0.0-20220412211240-33da011f77ad │ golang: syscall: faccessat checks wrong group                │
│                                  │                     │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-29526                   │
└──────────────────────────────────┴─────────────────────┴──────────┴───────────────────────────────────┴───────────────────────────────────┴──────────────────────────────────────────────────────────────┘

After:

❯ trivy fs .
2022-08-29T09:14:32.395+1200	INFO	Number of language-specific files: 2
2022-08-29T09:14:32.395+1200	INFO	Detecting bundler vulnerabilities...
2022-08-29T09:14:32.396+1200	INFO	Detecting gomod vulnerabilities...

docs/Gemfile.lock (bundler)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


go.mod (gomod)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

[hookenz]

/assign @cdrage

[hangyan]

Looks good. Thanks

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hangyan, hookenz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [hangyan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment