Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[bitnami/nginx] Security Vulnerabilities #7297

Closed
divya-kp-nair opened this issue Sep 21, 2022 · 4 comments
Closed

[bitnami/nginx] Security Vulnerabilities #7297

divya-kp-nair opened this issue Sep 21, 2022 · 4 comments
Assignees
@migruiz4
Labels
nginx solved stale 15 days without activity tech-issues The user has a technical issue about an application

Comments

@divya-kp-nair
Copy link

divya-kp-nair commented Sep 21, 2022 •
edited by fmulero

Name and Version

bitnami/nginx:1.22.0-debian-11-r40

What steps will reproduce the bug?

Vulnerabilities are listed by Prismascan (Twistlock) tool

What is the expected behavior?

No critical vulnerabilities expected

What do you see instead?

Vulnerabilities
+----------------+----------+------+---------+---------+--------------------------+
|      CVE       | SEVERITY | CVSS | PACKAGE | VERSION |          STATUS          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-38297 | critical | 9.80 | go      | 1.16.7  | fixed in 1.17.2, 1.16.9  |
|                |          |      |         |         | > 11 months ago          |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-23806 | critical | 9.10 | go      | 1.16.7  | fixed in 1.17.7, 1.16.14 |
|                |          |      |         |         | > 7 months ago           |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30580 | high     | 7.80 | go      | 1.16.7  | fixed in 1.18.3, 1.17.11 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-32189 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.5, 1.17.13 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30635 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30633 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30632 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30631 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-30630 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-28327 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.1, 1.17.9  |
|                |          |      |         |         | > 5 months ago           |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-28131 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.4, 1.17.12 |
|                |          |      |         |         | 41 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-27664 | high     | 7.50 | go      | 1.16.7  | fixed in 1.19.1, 1.18.6  |
|                |          |      |         |         | 14 days ago              |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-24921 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.8, 1.16.15 |
|                |          |      |         |         | > 6 months ago           |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-24675 | high     | 7.50 | go      | 1.16.7  | fixed in 1.18.1, 1.17.9  |
|                |          |      |         |         | > 5 months ago           |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-23773 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.7, 1.16.14 |
|                |          |      |         |         | > 7 months ago           |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2022-23772 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.7, 1.16.14 |
|                |          |      |         |         | > 7 months ago           |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-44716 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.5, 1.16.12 |
|                |          |      |         |         | > 8 months ago           |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-41772 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.3, 1.16.10 |
|                |          |      |         |         | > 10 months ago          |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-41771 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.3, 1.16.10 |
|                |          |      |         |         | > 10 months ago          |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-39293 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17.1, 1.16.8  |
|                |          |      |         |         | > 8 months ago           |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+
| CVE-2021-29923 | high     | 7.50 | go      | 1.16.7  | fixed in 1.17            |
|                |          |      |         |         | > 1 years ago            |
|                |          |      |         |         |                          |
|                |          |      |         |         |                          |
+----------------+----------+------+---------+---------+--------------------------+

Vulnerabilities found for image : total - 21, critical - 2, high - 19, medium - 0, low - 0
Vulnerability threshold check results: FAIL
Scan failed due to vulnerability policy violations: All Collections: CI Builds: ALERT on High and FAIL on Critical, 2 vulnerabilities, [critical:2]

Additional information

All vulnerabilities are related to go package with version 1.16.7 which I think comes from the gosu version installed via Dockerfile https://github.com/bitnami/containers/blob/main/bitnami/nginx/1.22/debian-11/Dockerfile#L39

Would it be possible to update the go package please?
@divya-kp-nair divya-kp-nair added the tech-issues The user has a technical issue about an application label Sep 21, 2022
@bitnami-bot bitnami-bot added this to Triage in Support Sep 21, 2022
@github-actions github-actions bot added the triage Triage is needed label Sep 21, 2022
@fmulero fmulero added the nginx label Sep 22, 2022
@fmulero fmulero changed the title Security Vulnerabilities [bitnami/nginx] Security Vulnerabilities Sep 22, 2022
@fmulero fmulero moved this from Triage to In progress in Support Sep 22, 2022
@github-actions github-actions bot added in-progress and removed triage Triage is needed labels Sep 22, 2022
@bitnami-bot bitnami-bot assigned migruiz4 and unassigned fmulero Sep 22, 2022
@migruiz4
Copy link
Member

Hi @divya-kp-nair,

We use the latest release of gosu (1.14) which was compiled with Go 1.16.7

You can check here a list of Go CVEs that do not apply to gosu, which includes all the CVEs in the above list: tianon/gosu#104

We regularly report any new vulnerability found to ensure it does not apply to gosu, and in case gosu releases a new version, we will update all of our images that include it.

@github-actions github-actions bot moved this from In progress to Pending in Support Sep 22, 2022
@github-actions
Copy link

github-actions bot commented Oct 8, 2022

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.

@github-actions github-actions bot added the stale 15 days without activity label Oct 8, 2022
@github-actions
Copy link

Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary.

@bitnami-bot bitnami-bot moved this from Pending to Solved in Support Oct 13, 2022
@github-actions github-actions bot removed this from Solved in Support Jan 25, 2023
@carrodher
Copy link
Member

Hi, we are glad to announce that we got rid of gosu in all Bitnami container images, so the false positives previously reported by some CVE scanners will not appear anymore:

$ trivy image --ignore-unfixed bitnami/postgresql:15.2.0-debian-11-r22

bitnami/postgresql:15.2.0-debian-11-r22 (debian 11.6)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

opt/bitnami/common/bin/gosu (gobinary)

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 0)

┌────────────────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                           Title                            │
├────────────────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ github.com/opencontainers/runc │ CVE-2022-29162 │ HIGH     │ v1.1.0            │ v1.1.2        │ runc: incorrect handling of inheritable capabilities       │
│                                │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-29162                 │
│                                ├────────────────┤          │                   ├───────────────┼────────────────────────────────────────────────────────────┤
│                                │ CVE-2023-27561 │          │                   │ v1.1.5        │ runc: volume mount race condition (regression of           │
│                                │                │          │                   │               │ CVE-2019-19921)                                            │
│                                │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2023-27561                 │
│                                ├────────────────┼──────────┤                   ├───────────────┼────────────────────────────────────────────────────────────┤
│                                │ CVE-2022-24769 │ MEDIUM   │                   │ v1.1.2        │ moby: Default inheritable capabilities for linux container │
│                                │                │          │                   │               │ should be empty                                            │
│                                │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-24769                 │
└────────────────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

VS

$ trivy image --ignore-unfixed bitnami/postgresql:15.2.0-debian-11-r23

bitnami/postgresql:15.2.0-debian-11-r23 (debian 11.6)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

From now on, gosu functionalities were replaced by chroot. In this PR you can find an example of this implementation.

@github-actions github-actions bot added this to Pending in Support May 3, 2023
@carrodher carrodher moved this from Pending to Solved in Support May 3, 2023
@github-actions github-actions bot removed this from Solved in Support May 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@migruiz4 migruiz4

Labels
nginx solved stale 15 days without activity tech-issues The user has a technical issue about an application
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@bitnami-bot @carrodher @fmulero @migruiz4 @divya-kp-nair