Skip to content

Conversation

javirln
Copy link
Member

@javirln javirln commented Apr 22, 2025

This patch upgrades Atlas to v0.32.1-819f32c-canary to address the CVE GHSA-vvgc-356p-c3xw

It also reverts the Atlas version in the common script to the previously working one, as the updated version caused issues in that context.

New version of Atlas does not show any CVE at this moment:

$ grype arigaio/atlas@sha256:5b52e74c938e2e32df081be435501d0de8f7a019840d7cc844997e6af0061bc1
 ✔ Loaded image                                                                                                                        arigaio/atlas@sha256:5b52e74c938e2e32df081be435501d0de8f7a019840d7cc844997e6af0061bc1
 ✔ Parsed image                                                                                                                                      sha256:8742ad5b19d0fb9803c95496d8f88eea812f4625f4c50ff1e68bb330f812fc34
 ✔ Cataloged contents                                                                                                                                       a737a875af700b62d5af7fe402566ca511b344128a22d4c79225d763819b627f
   ├── ✔ Packages                        [146 packages]
   ├── ✔ Executables                     [1 executables]
   ├── ✔ File metadata                   [942 locations]
   └── ✔ File digests                    [942 files]
 ✔ Scanned for vulnerabilities     [0 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 0 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 0 not-fixed, 0 ignored
No vulnerabilities found
$ trivy image arigaio/atlas@sha256:5b52e74c938e2e32df081be435501d0de8f7a019840d7cc844997e6af0061bc1
2025-04-22T09:47:30+02:00	INFO	[vuln] Vulnerability scanning is enabled
2025-04-22T09:47:30+02:00	INFO	[secret] Secret scanning is enabled
2025-04-22T09:47:30+02:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-04-22T09:47:30+02:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.57/docs/scanner/secret#recommendation for faster secret detection
2025-04-22T09:47:30+02:00	INFO	Detected OS	family="debian" version="12.10"
2025-04-22T09:47:30+02:00	INFO	[debian] Detecting vulnerabilities...	os_version="12" pkg_num=3
2025-04-22T09:47:30+02:00	INFO	Number of language-specific files	num=1
2025-04-22T09:47:30+02:00	INFO	[gobinary] Detecting vulnerabilities...

arigaio/atlas@sha256:5b52e74c938e2e32df081be435501d0de8f7a019840d7cc844997e6af0061bc1 (debian 12.10)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>
@javirln javirln requested review from migmartri and jiparis April 22, 2025 07:47
@javirln javirln self-assigned this Apr 22, 2025
@jiparis
Copy link
Member

jiparis commented Apr 22, 2025

It also reverts the Atlas version in the common script to the previously working one, as the updated version caused issues in that context.
Thanks. I totally forgot this one, they haven't yet released that version.

@javirln javirln merged commit 52caac0 into chainloop-dev:main Apr 22, 2025
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants