-
Notifications
You must be signed in to change notification settings - Fork 70
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Trivy and Aqua Enterprise vulnerability scan results critical and high #802
Comments
Regarding that oc-related docker golang vulnerability, posted a question directly at oc |
I saw that discussed somewhere. Yeah, as they are telling you on your ticket, govulncheck scan that analyzes reachability would tell that the vulnerable code is not called, and so the vulnerability got downgraded from critical to something fairly down on the list. https://www.redhat.com/en/blog/red-hats-open-approach-vulnerability-management |
What steps did you take and what happened:
Took e.g. a recent R Studio image build. Got the following vulnerabilities findings. I realize not all are valid in all contexts, i.e. Docker one regarding Docker with Auth .... but some could be fixed easily, e.g. upgrading setuptools along with pip and wheel ...
e.g. in an R Studio image based on
quay.io/sclorg/python-39-c9s:c9s
which itself seems to be based on https://github.com/sclorg/s2i-python-container/blob/master/3.9/Dockerfile.c9s#L3What did you expect to happen:
No critical vulnerabilities and as little as possible high ones.
Anything else you would like to add:
how about e.g.
setuptools 75.6.0
wheel 0.45.1
pip 24.3.1
at level python
and Docker 25.0.6 at base image level
The docker vulnerability
CVE-2024-41110
seems to be part of/opt/app-root/bin/oc
https://github.com/openshift/oc/blob/master/go.mod#L19
Environment:
Logs/Screenshots
The text was updated successfully, but these errors were encountered: