Cadence Server Image Contains Vulnerable Packages (CVE-2022-0778)

[WToma]

Version of Cadence server, and client(which language)
This is very important to root cause bugs.

• Server version: master branch
• Client version: N/A
• Client langauge: N/A

Describe the bug
Automated vulnerability scanner reports vulnerable OS package OpenSSL 1.1.1l, coming from Alpine-3.11. Vulnerabliity: https://people.canonical.com/~ubuntu-security/cve/2022/CVE-2022-0778. Fixed in 1.1.1n, which is included in Alpine-3.15.

To Reproduce
N/A

Steps to reproduce the behavior:
N/A

Expected behavior
N/A

Screenshots
N/A

Additional context
N/A

[WToma]

#4804

[sonpham96]

Hi, PR #4804 might help fix CVE-2022-29458 and CVE-2021-39537 caused by ncurses 6.1_p20200118-r4 in Alpine Linux 3.11. There had been an attempt to fix it before (#4689) and it was released in Cadence Server v0.24.0. However, it looks like our vulnerability scanner (Twistlock) still pick it up. These CVEs are scored High and we need to resolve them as soon as possible to comply with our client's standards. Could this be released in the next release?

[vytautas-karpavicius]

Hi, yes #4804 will be picked up in the next release.

[sonpham96]

Hi, yes #4804 will be picked up in the next release.

Great! Thanks a lot for this! I have been able to built Cadence server image on local (on tag v0.24.0 but not much success for master though). Then, I ran the Twistlock scan and I can confirm that bumping alpine to alpine:3.15 is going to fix the following list of CVEs:

• Caused by zlib 1.2.11-r3
  • CVE-2022-37434 (critical)
  • CVE-2018-25032 (high)
• Caused by curl 7.79.1-r0
  • CVE-2022-32207 (critical)
  • CVE-2022-22576 (high)
  • CVE-2022-27782 (high)
  • CVE-2022-27781 (high)
  • CVE-2022-27775 (high)
  • CVE-2022-32206 (medium)
  • CVE-2022-27776 (medium)
  • CVE-2022-32208 (medium)
  • CVE-2022-27774 (medium)
  • CVE-2022-32205 (medium)
• Caused by openssl 1.1.1l-r0
  • CVE-2022-2068 (critical)
  • CVE-2022-1292 (critical)
  • CVE-2022-2097 (high)
  • CVE-2022-0778 (high)
  • CVE-2021-4160 (medium)
• Caused by busybox 1.31.1-r11
  • CVE-2022-28391 (high)
• Caused by ncurses 6.1_p20200118-r4
  • CVE-2021-39537 (high)
  • CVE-2022-29458 (high)