High Software vulnerability issue in thanos because of busybox

[hariyada]

Hi All,

Thanos latest version is having high software vulnerability issue because of busy-box which was come as part of black duck binary software analysis

issue reported : https://nvd.nist.gov/vuln/detail/CVE-2021-28831

note: prometheus also faced it and fixed it like this prometheus/graphite_exporter#154

[wiardvanrij]

Thank you for reporting! I'll look into this

[wiardvanrij]

Actually, I've been pointed that we already use the latest. In the build the sha in the Makefile is used. However I guess it's fine to update the base as-well. :D

[hariyada]

@wiardvanrij thank you very much, any idea when will be the new version available?

[wiardvanrij]

@wiardvanrij thank you very much, any idea when will be the new version available?

I actually edited something that as no effect basically :D - The hash was already updated in our Makefile. The latest Thanos releases already have the latest busybox version.