Updated KUBECTL_VERSION to 1.31.0 for fixing vulnerabilities #1690
Conversation
jdesouza
changed the title
jdesouza
changed the title
|
Looks good although a kubectl vulnerability is likely to remain |
@jdesouza Could you please update this PR to upgrade only the kubectl version? Thanks! |
WDYT now? |
go.mod
Outdated
| @@ -1,6 +1,6 @@ | |||
| module github.com/aquasecurity/kube-bench | |||
|
|
|||
| go 1.22 | |||
| go 1.22.7 | |||
There was a problem hiding this comment.
IMHO, we should avoid updating this version in the go.mod file. This change will force all developers (including kube-bench maintainers and downstream project developers) to download go >=1.22.7.
@afdesk wdyt?
There was a problem hiding this comment.
@mozillazg I definitely agree with you!
my point was that we already use Go 1.22.7 for building in pipelines.
There was a problem hiding this comment.
Thanks for the review! Just reverted the go change. Now we have just the kubectl update
|
Alpine version was alredy bumped via #1676 |
jdesouza
changed the title
usr/local/bin/kubectl (gobinary)
Total: 3 (HIGH: 2, CRITICAL: 1)
┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2024-24790 │ CRITICAL │ fixed │ 1.21.7 │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for │
│ │ │ │ │ │ │ IPv4-mapped IPv6 addresses │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24790 │
│ ├────────────────┼──────────┤ │ ├─────────────────┼────────────────────────────────────────────────────────────┤
│ │ CVE-2023-45288 │ HIGH │ │ │ 1.21.9, 1.22.2 │ golang: net/http, x/net/http2: unlimited number of │
│ │ │ │ │ │ │ CONTINUATION frames causes DoS │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45288 │
│ ├────────────────┤ │ │ ├─────────────────┼────────────────────────────────────────────────────────────┤
│ │ CVE-2024-34156 │ │ │ │ 1.22.7, 1.23.1 │ encoding/gob: golang: Calling Decoder.Decode on a message │
│ │ │ │ │ │ │ which contains deeply nested structures... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-34156 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴────────────────────────────────────────────────────────────┘