CVE-2020-8558 for k8s.io/kubernetes v1.14.6

[michaeljobrien]

Our security scanner is identifying CVE-2020-8558 for node-problem-detector due to k8s.io/kubernetes version 1.14.6.

Are their plans to update this module or node-problem-detector somehow confirmed as not vulnerable?

[jmhbnz]

This would be resolved by #706 once merged.

[Dentrax]

It'd be great if someone helped me on that PR. I got lost and don't know why tests are failing. Since almost months passed from submitting, now I have to update all the deps again to match with upstream k8s repo. Feel free to ping me. Or, we can submit a particular PR to remediate this specific vulnerability.

[pluzun]

I agree about the need to bump dependencies.

[yaron-idan]

Hey @Dentrax , I would like to create a PR that would remediate the kubernetes vulnerability mentioned in this issue. Would you be willing to explain how this patch can be separated from the rest of the code in #706 (if that's even possible)?

Thanks.

[Dentrax]

Hey @Dentrax , I would like to create a PR that would remediate the kubernetes vulnerability mentioned in this issue. Would you be willing to explain how this patch can be separated from the rest of the code in #706 (if that's even possible)?

Thanks.

Hey! Thanks for the interest. At PR #706, I couldn't able to make CI pass after lots of work. And I decided to abandon it.

So let me ping the maintainer, maybe @vteratipally got a thought on this.

[yaron-idan]

Hey @Dentrax, I've created a branch which cherry picks the changes you made in order to tackle the CVE mentioned in the issue. Thank you for the work you've done in #706, it was crucial for allowing me to create this change.
Since most of the changes introduced here were originally written by you, I wanted to touch base before submitting a PR, in case you'd like to do so yourself.

[yaron-idan]

I've created PR #761 to address the CVE this issue discusses. Please take a look.

[Dentrax]

I made a CVE-free version of node-problem-detector! Check this out: https://github.com/chainguard-images/images/tree/main/images/node-problem-detector

cgr.dev/chainguard/node-problem-detector:latest

[hakman]

This should be fixed by #806.
/close

[k8s-ci-robot]

@hakman: Closing this issue.

In response to this:

This should be fixed by #806.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.