Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Patch version uplift for Docker + GRPC #2219

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

Hacks4Snacks
Copy link
Contributor

Description

Related issues

Before:
10:24:03 |base|m@bl460c-9 trivy-operator ±|main|→ trivy fs .
2024-08-08T10:24:05-05:00 INFO [vuln] Vulnerability scanning is enabled
2024-08-08T10:24:05-05:00 INFO [secret] Secret scanning is enabled
2024-08-08T10:24:05-05:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-08-08T10:24:05-05:00 INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.54/docs/scanner/secret#recommendation for faster secret detection
2024-08-08T10:24:11-05:00 INFO Number of language-specific files num=1
2024-08-08T10:24:11-05:00 INFO [gomod] Detecting vulnerabilities...

go.mod (gomod)

Total: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 1)

┌──────────────────────────┬─────────────────────┬──────────┬────────┬─────────────────────┬─────────────────────────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────────────────────┼─────────────────────┼──────────┼────────┼─────────────────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2024-41110 │ CRITICAL │ fixed │ 26.1.3+incompatible │ 23.0.14, 26.1.4, 27.1.0, 25.0.6 │ moby: Authz zero length regression │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-41110
├──────────────────────────┼─────────────────────┼──────────┤ ├─────────────────────┼─────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-xr7q-jx4m-x55m │ LOW │ │ 1.64.0 │ 1.64.1 │ Private tokens could appear in logs if context containing │
│ │ │ │ │ │ │ gRPC metadata is... │
│ │ │ │ │ │ │ GHSA-xr7q-jx4m-x55m
└──────────────────────────┴─────────────────────┴──────────┴────────┴─────────────────────┴─────────────────────────────────┴───────────────────────────────────────────────────────────┘

After :
10:20:32 |base|m@bl460c-9 trivy-operator ±|hacks4snacks/vulnpatch ✗|→ trivy fs .
2024-08-08T10:21:05-05:00 INFO [vuln] Vulnerability scanning is enabled
2024-08-08T10:21:05-05:00 INFO [secret] Secret scanning is enabled
2024-08-08T10:21:05-05:00 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-08-08T10:21:05-05:00 INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.54/docs/scanner/secret#recommendation for faster secret detection
2024-08-08T10:21:12-05:00 INFO Number of language-specific files num=1
2024-08-08T10:21:12-05:00 INFO [gomod] Detecting vulnerabilities...

No detections

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@Hacks4Snacks Hacks4Snacks changed the title Patch version uplift for Docker + GRPC fix: Patch version uplift for Docker + GRPC Aug 8, 2024
@github-actions github-actions bot added the bug label Aug 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Critical vulnerability in trivy-operator:0.22.0 image (CVE-2024-41110)
1 participant