When we can Expect release date of new version contains some vulnerabile packages fix for csi-driver-smb

[tomthomas123]

Hi Team,
We are facing vulnerability issues with the following packages in csi-driver-smb version smbplugin:v1.14.0 identified in a security scan.

• smbplugin:v1.14.0

1. github.com/emicklei/go-restful/v3 v3.9.0
2. libc6,libc-bin 2.36-9+deb12u3
3. libgnutls30 3.7.9-2+deb12u1

The security scanning tool suggests upgrading to below versions to resolve the issue.

• smbplugin:v1.14.0

1. github.com/emicklei/go-restful/v3 fixed in v3.10.0
2. libc6,libc-bin fixed in 2.36-9+deb12u4
3. libgnutls30 fixed in 3.7.9-2+deb12u2

Could you please provide an estimated release date for a new Release that includes the above vulnerabilities fiexd package versions.?

[andyzhangx]

@tomthomas123 can you check whether this image(gcr.io/k8s-staging-sig-storage/smbplugin:canary) has CVE? if not, I will cut v1.15.0 release, thx.

[tomthomas123]

@andyzhangx While checking on the same, i have done a vulnerability scan then i noticed the below things for the gcr.io/k8s-staging-sig-storage/smbplugin:canary image with SHA sha256:9872d75a5c474a101d898b8a841e3d3bc277f7b1f87f0334eff43d2007c2f419

1. The package github.com/emicklei/go-restful/v3 v3.9.0 having a high vulnerability with the CVE ID PRISMA-2022-0227 found while my customer done a detailed vulnerability scan. Their on tool suggesting to upgrade the respective package into the github.com/emicklei/go-restful/v3 v3.10.0 version. Can you please consider this as a Residual Risk and do the needful.
2. The package version glibc-2.36-9+deb12u7 is upto the standards. Please proceed with the same.
3. The package version gnutls28 3.7.9-2+deb12u3 is upto the standards. Please proceed with the same.

Please note the below point:-

While scanning the current image with canary tag gcr.io/k8s-staging-sig-storage/smbplugin:canary with the Sha sha256:9872d75a5c474a101d898b8a841e3d3bc277f7b1f87f0334eff43d2007c2f419 we found :

• Critical vulnerability for stdlib 1.22.3 with the CVE ID CVE-2024-24790 and the scanning tool suggests Fix version 1.22.4 for the stdlib package.
• High vulnerability for stdlib 1.22.3 with the CVE ID CVE-2024-24791 and the scanning tool suggests Fix version 1.22.5 for the stdlib package.
• Medium vulnerability for stdlib 1.22.3 with the CVE ID CVE-2024-24789 and the scanning tool suggests Fix version 1.22.4 for the stdlib package.
• Medium vulnerability for k8s.io/apiserver 0.28.9 with the CVE ID CVE-2020-8552 and the scanning tool suggests Fix versions 1.15.10, 1.16.7, 1.17.3 for the stdlib package.

Please consider these are the Residual Risk and do needful before the new version-v1.15.0 releases.

[andyzhangx]

PRISMA-2022-0227 could be fixed by #802, and CVE-2020-8552 is wrong since 0.28.9 stands for k8s 1.28.9, it's much higher version than 1.17.3, we cannot use 1.17.3 since it's too old version and has lots of CVEs

Medium vulnerability for k8s.io/apiserver 0.28.9 with the CVE ID CVE-2020-8552 and the scanning tool suggests Fix versions 1.15.10, 1.16.7, 1.17.3 for the stdlib package.

stdlib is related to go version used by building all csi images in upstream, need to figure out how to upgrade go version in image build tool, tracking here: kubernetes/k8s.io#6908 (comment)

not sure how to fix the lib issue since we have already used apt upgrade -y to upgraded to latest patches.

csi-driver-smb/cmd/smbplugin/Dockerfile

Line 17 in 8851b25

RUN apt update && apt upgrade -y && apt-mark unhold libcap2 && clean-install ca-certificates cifs-utils util-linux e2fsprogs mount udev xfsprogs

[tomthomas123]

@andyzhangx So, Understanding the PRISMA-2022-0227 is fixed and the CVE-2020-8552 is wrong since the version is higher than the fix suggested by the tool. When i can avail the new version of smbplugin with these changes?. Can you please provide an ETA so i can plan with my team accordingly.

[andyzhangx]

we need to wait for go version change in upstream image build first: kubernetes/k8s.io#6908 (comment)

[andyzhangx]

smbplugin:canary should have be better

# trivy image --ignore-unfixed gcr.io/k8s-staging-sig-storage/smbplugin:canary
2024-07-12T09:13:36.906Z        INFO    Vulnerability scanning is enabled
2024-07-12T09:13:36.906Z        INFO    Secret scanning is enabled
2024-07-12T09:13:36.906Z        INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2024-07-12T09:13:36.906Z        INFO    Please see also https://aquasecurity.github.io/trivy/v0.36/docs/secret/scanning/#recommendation for faster secret detection
2024-07-12T09:13:37.272Z        INFO    Detected OS: debian
2024-07-12T09:13:37.272Z        INFO    Detecting Debian vulnerabilities...
2024-07-12T09:13:37.291Z        INFO    Number of language-specific files: 1
2024-07-12T09:13:37.291Z        INFO    Detecting gobinary vulnerabilities...

gcr.io/k8s-staging-sig-storage/smbplugin:canary (debian 12.6)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

[andyzhangx]

v1.15.0 has been released