Comments (6)
Vulnerability is still visible with 0.15.0 image. Aqua security tool shows it specifically for go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
but go.opentelemetry.io/contrib/instrumentation
was replaced by PR #264
Below command shows the security vulnerability
# docker run -v /var/run/docker.sock:/var/run/docker.sock -v $HOME/Library/Caches:/root/.cache/ aquasec/trivy:0.46.0 image quay.io/brancz/kube-rbac-proxy:v0.15.0
from kube-rbac-proxy.
So you are saying that there is a vulnerability scanner, that finds a vulnerability in the dependencies, which isn't being used by kube-rbac-proxy and doesn't affect kube-rbac-proxy, but blocks your release? Oh, my...
We need a better solution for this. Time-wise it is pretty intensive to release several times a month.
I will try to make a release tomorrow (CEST). I don't want to block anyone's release.
from kube-rbac-proxy.
Yeah unfortunately I think we should reopen this ticket or create a new one to track this effort.
Many of us use trivy to scan our code, and you can even create a github action to run these scans. You could also use Dependabot to keep these packages up to date and reduce maintenance effort overall on these vulnerabilities.
So you are saying that there is a vulnerability scanner, that finds a vulnerability in the dependencies, which isn't being used by kube-rbac-proxy and doesn't affect kube-rbac-proxy, but blocks your release? Oh, my...
Yeah while it gets to be a pain since we are bound to have transient dependencies that have vulnerable code we don't use in them, I've learned that many companies track vulnerable packages that their software imports regardless of whether they can be exploited. In the end, The general idea is that when it comes to library packages with vulnerable code, even if you don't use the code today, there's always the risk that a future commit will. No developer can really know if the method they are using from a library is vulnerable while they are adding it in so they can't be expected to worry about that while they are writing their code. I'm not aware of IDEs smart enough to track this and warn you. The best we can do today is to keep our packages up to date using tools like Dependabot, so that we can spend less time worrying about package management and vulnerabilities.
from kube-rbac-proxy.
With found, you mean that you have a working example of it being abused?
Checking the description of the CVE, I don't see a codepath that would affect kube-rbac-proxy.
If it would be a high severity CVE that affects us, I would drop everything and fix it right now. As it doesn't look like so and in the context of http/2 discussions going on, I might still create another release this week, which would replace the dep.
from kube-rbac-proxy.
I do not have any working example of it being abused. But with this high vulnerability, we could not use and deploy this release.
from kube-rbac-proxy.
Sorry, i was to tired yesterday, but it should be fixed with v0.15.0
from kube-rbac-proxy.
Related Issues (20)
- Bump golang version HOT 2
- Sig-Auth Pre-Acceptance 2nd Review HOT 10
- Cut a new release with golang version 1.20 HOT 3
- Add livenessProbe support for kube-rbac-proxy HOT 2
- Twistlock reporting CVE PRISMA-2022-0227 HOT 2
- kube-rbac-proxy failing authentication and authorization intermittently with error: HOT 2
- Option to output the logs as JSON HOT 1
- vulnerabilities on kube-rbac-proxy v0.14.2 HOT 2
- Image of kube-rbac-proxy new version (v0.14.3) wasn't pushed to quay.io repository HOT 4
- Failing to instantiate OIDC authenticator when --oidc-ca-file is not specified HOT 6
- Can they be friends --ignore-path and --allow-path? HOT 3
- CVE high security vulnerabilities found in image: quay.io/brancz/kube-rbac-proxy:v0.15.0 HOT 14
- Compability with new K8S versions HOT 2
- Can kube rbac proxy be used for kubeedge? HOT 3
- CVE vulnerabilities found for golang-runtime:1.20.4 (usr/local/bin/kube-rbac-proxy) HOT 3
- Multi Arch Image pulled from quay.io does not work in arm64/graviton nodes HOT 3
- 0.16 Image does not appear to be available HOT 3
- CVE-2023-47108 "Vulnerability detected affecting otelgrpc v0.42.0" found in kube-rbac-proxy v0.16.0 HOT 7
- [HELP] Trying to expose Hubble UI with kube-rbac-proxy HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kube-rbac-proxy.