prometheus-auth is using an old unmaintained version of Alpine Linux.

[rogersd]

The Dockerfile for prometheus-auth specifies an old, unmaintained version of Alpine Linux (3.8).

This already contains multiple CVEs, such as:

CVE-2019-1551
CVE-2019-14697
CVE-2019-5482

It also specifies a two year old version of Go (1.11.1) that has multiple security fixes available: https://golang.org/doc/devel/release.html#go1.11

Please update this package and release a new version.

Thanks.

[aiyengar2]

Thanks for submitting this issue to us!

FYI I believe the Dockerfile.dapper linked in the original issue description is the one used by Dapper for our build scripts, so the Go version shouldn't make a difference, but I'll update that anyways.

However, it seems like the Dockerfile used for prometheus-auth is also still at alpine 3.8, so I'll update that to 3.12.

[rogersd]

Thanks for submitting this issue to us!

FYI I believe the Dockerfile.dapper linked in the original issue description is the one used by Dapper for our build scripts, so the Go version shouldn't make a difference, but I'll update that anyways.

However, it seems like the Dockerfile used for prometheus-auth is also still at alpine 3.8, so I'll update that to 3.12.

Fantastic, thank you!

[aiyengar2]

Note to QA

We initially had an issue in #29342 that tracked the 2.4 backport, but this issue is only ever being merged into 2.4 so I closed that ticket out in favor of this.

We should check in this ticket that the image is updated both in a 2.4 and 2.5 setup, but since the backend changes necessary are the same for both I'm leaving this as a single ticket to test both.

[jiaqiluo]

This bug fix is validated in rancher:v2.4-3950-head and rancher:v2.5-c32b5a14a8bc90a932c67735c3c42c44e48183e7-head single install, with the monitoring v1 0.1.4

Steps:

• enable monitoring v1 0.1.4
• set the branch of system-library to dev-v2.4
• go the check the statefulSet prometheus-cluster-monitoring

Results:

• the image rancher/prometheus-auth:v0.2.1 is used, and it uses alpine:3.12 and golang:1.15.2-alpine3.12 internally

[rogersd]

Thank you! I'll look forward to seeing this in the next release!

[deniseschannon]

@jiaqiluo Can you test this version for v2.4.9?

[jiaqiluo]

Close this issue since both v2.4-head and master-head were tested, and v2.4-head is for v2.4.9.
See my previous comment for details.
cc @deniseschannon