Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kubseal 0.27.1 binary flagged by Trivy for Go stdlib CVE #1612

Closed
pjonsson opened this issue Oct 16, 2024 · 0 comments · Fixed by #1621
Closed

Kubseal 0.27.1 binary flagged by Trivy for Go stdlib CVE #1612

pjonsson opened this issue Oct 16, 2024 · 0 comments · Fixed by #1621
Labels
backlog Issues/PRs that will be included in the project roadmap security

Comments

@pjonsson
Copy link

Which component:
kubeseal 0.27.1

Describe the bug
Running Trivy on a Docker image that contains the kubeseal 0.27.1 binary gives the following output:

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                           Title                           │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2024-34156 │ HIGH     │ fixed  │ 1.22.5            │ 1.22.7, 1.23.1 │ encoding/gob: golang: Calling Decoder.Decode on a message │
│         │                │          │        │                   │                │ which contains deeply nested structures...                │
│         │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-34156                │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴───────────────────────────────────────────────────────────┘

To Reproduce

  1. Build a Docker image with kubeseal 0.27.1 binary
  2. Run Trivy on the Docker image.

Expected behavior

Version of Kubernetes:

No engagement with Kubernetes required.

Additional context

Could you please make a release built with a more recent stdlib so security scanners don't flag the binary as containing a high severity vulnerability?

@pjonsson pjonsson added the triage Issues/PRs that need to be reviewed label Oct 16, 2024
@agarcia-oss agarcia-oss added security backlog Issues/PRs that will be included in the project roadmap and removed triage Issues/PRs that need to be reviewed labels Oct 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backlog Issues/PRs that will be included in the project roadmap security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants