Comments (14)
Thx for reporting this to us. We will create an update.
Most of the times the CVEs don't impact us directly, as we don't use those code paths.
from kube-rbac-proxy.
Those are indirect dependencies. I would need to bump k8s.io, which would lead to a potential err on everyone using deprecated flags. I need to check how to resolve this.
from kube-rbac-proxy.
thanks so much for working on this, appreciated.
from kube-rbac-proxy.
Hm, as I am working on that, I am surprised that it claims that we have go.opentelemetry.io/contrib/instrumentation v0.20.0
.
We have already a replace directive to bump it to v0.44.0. So CVE-2023-45142 shouldn't be reported. I hope your tool interprets replace directives.
from kube-rbac-proxy.
The CVEs are related to the HTTP/2 issue, right? We added the capability to disable HTTP/2.
from kube-rbac-proxy.
The tool: trivy or grype are open source vulnerabilities scan tools, you can install them on your machine and scan the image.
Not sure if you can upgrade the dependency according to below instructions?
![image](https://private-user-images.githubusercontent.com/47620416/292108515-0a29aecc-1a3d-4b95-8523-a1888f65ddba.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTE2NjMzODIsIm5iZiI6MTcxMTY2MzA4MiwicGF0aCI6Ii80NzYyMDQxNi8yOTIxMDg1MTUtMGEyOWFlY2MtMWEzZC00Yjk1LTg1MjMtYTE4ODhmNjVkZGJhLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDAzMjglMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwMzI4VDIxNTgwMlomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTQzY2YxZGY0OTlhMGFhMThmZTI3YTk0NTE5YTY0N2M2ZmIzZGI3ZGIxYjNkNTQxMDRlZjI4OThmNTEzMmM3YmEmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Ua8CW73mcZilKuc95ybY04wy6q4pnw1nU6pVY573H5s)
thanks
Jane
from kube-rbac-proxy.
Oh, thanks for the hint. I will check them out!
from kube-rbac-proxy.
#276, should solve it.
from kube-rbac-proxy.
With v0.16.0 only otelgrpc remained as go.mod has v0.42.0 and fix is in v0.46.0
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH │ v0.20.0 │ 0.46.0 │ otelgrpc DoS vulnerability due to unbound cardinality │ │ rg/grpc/otelgrpc
from kube-rbac-proxy.
@ibihim there is still one high security vuln which needs to be fixed:
grype quay.io/brancz/kube-rbac-proxy:v0.16.0
✔ Vulnerability DB [updated]
✔ Parsed image sha256:2e4f0cff00eb27ccf559d9e80b7f4f46c673dcab0979aa1838718df415d4c1ee
✔ Cataloged packages [101 packages]
✔ Scanned for vulnerabilities [1 vulnerability matches]
├── by severity: 0 critical, 1 high, 0 medium, 0 low, 0 negligible
└── by status: 1 fixed, 0 not-fixed, 0 ignored
[0040] WARN some package(s) are missing CPEs. This may result in missing vulnerabilities. You may autogenerate these using: --add-cpes-if-none
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0 0.46.0 go-module GHSA-8pgv-569h-w5rw High
Affected code: https://github.com/brancz/kube-rbac-proxy/blob/release-0.16.0/go.mod#L72
Could you help fix it?
thanks
Jane
from kube-rbac-proxy.
Hi,
I will take a look, but CVEs in dependencies that are not within the code path of kube-rbac-proxy are not a priority. kube-rbac-proxy doesn't use any instrumentation itself.
I am the only maintainer and I need to prioritize and code changes to satisfy code scanners are not at the top. (In case you are curious: 1. Real CVEs, 2. Bugs, 3. the work to make it a kubernetes project is).
It is especially annoying to fix if upstream doesn't care too:
kubernetes/kubernetes#121338 (comment)
from kube-rbac-proxy.
Should be fixed with: #287
from kube-rbac-proxy.
Related Issues (20)
- Bump golang version HOT 2
- Sig-Auth Pre-Acceptance 2nd Review HOT 10
- Cut a new release with golang version 1.20 HOT 3
- Add livenessProbe support for kube-rbac-proxy HOT 2
- Twistlock reporting CVE PRISMA-2022-0227 HOT 2
- kube-rbac-proxy failing authentication and authorization intermittently with error: HOT 2
- Option to output the logs as JSON HOT 1
- vulnerabilities on kube-rbac-proxy v0.14.2 HOT 2
- Image of kube-rbac-proxy new version (v0.14.3) wasn't pushed to quay.io repository HOT 4
- Failing to instantiate OIDC authenticator when --oidc-ca-file is not specified HOT 6
- vulnerabilities on kube-rbac-proxy v0.14.4 HOT 6
- Can they be friends --ignore-path and --allow-path? HOT 3
- Compability with new K8S versions HOT 2
- Can kube rbac proxy be used for kubeedge? HOT 3
- CVE vulnerabilities found for golang-runtime:1.20.4 (usr/local/bin/kube-rbac-proxy) HOT 3
- Multi Arch Image pulled from quay.io does not work in arm64/graviton nodes HOT 3
- 0.16 Image does not appear to be available HOT 3
- CVE-2023-47108 "Vulnerability detected affecting otelgrpc v0.42.0" found in kube-rbac-proxy v0.16.0 HOT 7
- [HELP] Trying to expose Hubble UI with kube-rbac-proxy HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kube-rbac-proxy.