fix Twistlock scans as of 2024-12-20

[wanix]

Proposing some security fixes and updates:

Dockerfile

update to latest alpine

Version

update to 0.5.9

Fixes

I fixed the following errors by updating dependencies and Alpine:

+----------------+----------+------+-----------------------+-----------+--------------------+-----------+------------+------------+----------------------------------------------------+-------------------+
|      CVE       | SEVERITY | CVSS |        PACKAGE        |  VERSION  |       STATUS       | PUBLISHED | DISCOVERED | GRACE DAYS |                    DESCRIPTION                     | TRIGGERED FAILURE |
+----------------+----------+------+-----------------------+-----------+--------------------+-----------+------------+------------+----------------------------------------------------+-------------------+
| CVE-2024-45338 | high     | 0.00 | golang.org/x/net/html | v0.29.0   | fixed in 0.33.0    | 1 days    | < 1 hour   | 13         | An attacker can craft an input to the Parse        | No                |
|                |          |      |                       |           | 1 days ago         |           |            |            | functions that would be processed non-linearly     |                   |
|                |          |      |                       |           |                    |           |            |            | with respect to its length, resulting in extremely |                   |
|                |          |      |                       |           |                    |           |            |            | slow par...                                        |                   |
+----------------+----------+------+-----------------------+-----------+--------------------+-----------+------------+------------+----------------------------------------------------+-------------------+
| CVE-2024-9681  | medium   | 6.50 | curl                  | 8.10.1-r0 | fixed in 8.11.0-r0 | 44 days   | < 1 hour   | -14        | When curl is asked to use HSTS, the expiry time    | Yes               |
|                |          |      |                       |           | 43 days ago        |           |            |            | for a subdomain might overwrite a parent domain\'s |                   |
|                |          |      |                       |           |                    |           |            |            | cache entry, making it end sooner or later than    |                   |
|                |          |      |                       |           |                    |           |            |            | oth...                                             |                   |
+----------------+----------+------+-----------------------+-----------+--------------------+-----------+------------+------------+----------------------------------------------------+-------------------+
| CVE-2024-11053 | low      | 0.00 | curl                  | 8.10.1-r0 | fixed in 8.11.1-r0 | 9 days    | < 1 hour   | 92         | A flaw was found in curl. A logic error when       | No                |
|                |          |      |                       |           | 8 days ago         |           |            |            | processing credentials from the .netrc file        |                   |
|                |          |      |                       |           |                    |           |            |            | while performing redirects allows the transfer of  |                   |
|                |          |      |                       |           |                    |           |            |            | credentials...                                     |                   |
+----------------+----------+------+-----------------------+-----------+--------------------+-----------+------------+------------+----------------------------------------------------+-------------------+

Tested by using my generated image (on RDS PostgreSQL): docker.io/wanix/sql_exporter:v0.5.9
(no problem detected by Twistlock with this image also)

[wanix]

Files modified:

I did the manual changes on:

• Dockerfile (Alpine version for curl)
• go.mod (for golang.org/x/net/html)
• VERSION

Then:

go get
go mod tidy
go mod vendor

[OgunOzyurek]

lgtm

[dewey]

Looks good, thanks. Will push a new image.