-
Notifications
You must be signed in to change notification settings - Fork 188
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE high security vulnerabilities found in image: quay.io/brancz/kube-rbac-proxy:v0.15.0 #271
Comments
Thx for reporting this to us. We will create an update. Most of the times the CVEs don't impact us directly, as we don't use those code paths. |
Those are indirect dependencies. I would need to bump k8s.io, which would lead to a potential err on everyone using deprecated flags. I need to check how to resolve this. |
thanks so much for working on this, appreciated. |
Hm, as I am working on that, I am surprised that it claims that we have We have already a replace directive to bump it to v0.44.0. So CVE-2023-45142 shouldn't be reported. I hope your tool interprets replace directives. |
The CVEs are related to the HTTP/2 issue, right? We added the capability to disable HTTP/2. |
Oh, thanks for the hint. I will check them out! |
#276, should solve it. |
With v0.16.0 only otelgrpc remained as go.mod has v0.42.0 and fix is in v0.46.0 |
@ibihim there is still one high security vuln which needs to be fixed:
Affected code: https://github.com/brancz/kube-rbac-proxy/blob/release-0.16.0/go.mod#L72 Could you help fix it? thanks Jane |
Hi, I will take a look, but CVEs in dependencies that are not within the code path of kube-rbac-proxy are not a priority. kube-rbac-proxy doesn't use any instrumentation itself. I am the only maintainer and I need to prioritize and code changes to satisfy code scanners are not at the top. (In case you are curious: 1. Real CVEs, 2. Bugs, 3. the work to make it a kubernetes project is). It is especially annoying to fix if upstream doesn't care too: |
Should be fixed with: #287 |
@ibihim it looks like CVE-2023-45142 reappeared in v0.17.1 as the |
Should be fixed. If not, please reopen. #298 |
Hello Team,
We are using this image: quay.io/brancz/kube-rbac-proxy:v0.15.0 and inside of this image, we have scanned out two high security vulnerabilities. Could you help fix them?
You need to upgrade go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc in https://github.com/brancz/kube-rbac-proxy/blob/master/go.mod#L69 from v0.20.0 to v0.46.0 and also go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp in https://github.com/brancz/kube-rbac-proxy/blob/master/go.mod#L70 from v0.20.0 to v0.44.0 and google.golang.org/grpc in https://github.com/brancz/kube-rbac-proxy/blob/master/go.mod#L91 from v1.47.0 to v1.56.3
Thanks
Jane
The text was updated successfully, but these errors were encountered: