Many vulnarabilities are reported while we use this image as BASE image for Ceph CSI

[humblec]

We use latest image hash of ceph in our ( ceph-csi github.com/ceph/ceph-csi) container build process and running the scanner against the build returns too many vulnarabilities . This has become an issue for many users and also for the secuirty reports generated on ceph csi image. We can not do anything to fix these issues in our image or iow, it has to be fixed here.

Can you consider this in prioirty and address these vulnarabilities?

A recent run report can be seen here:

ceph/ceph-csi#3538

quay.io/cephcsi/cephcsi:test (redhat 8.6)
=========================================
Total: 14 (UNKNOWN: 0, LOW: 1, MEDIUM: 12, HIGH: 1, CRITICAL: 0)

┌───────────────────────┬────────────────┬──────────┬──────────────────────────────────────┬────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│        Library        │ Vulnerability  │ Severity │          Installed Version           │             Fixed Version              │                            Title                             │
├───────────────────────┼────────────────┼──────────┼──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ gnutls                │ CVE-2022-2509  │ MEDIUM   │ 3.6.16-5.el8                         │ 3.6.16-5.el8_6                         │ gnutls: Double free during gnutls_pkcs7_verify               │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2022-2509                    │
├───────────────────────┼────────────────┼──────────┼──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ libksba               │ CVE-2022-3515  │ HIGH     │ 1.3.5-7.el8                          │ 1.3.5-8.el8_6                          │ libksba: integer overflow may lead to remote code execution  │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2022-3515                    │
├───────────────────────┼────────────────┼──────────┼──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ platform-python       │ CVE-2015-20107 │ MEDIUM   │ 3.6.8-47.el8                         │ 3.6.8-47.el8_6                         │ python: mailcap: findmatch() function does not sanitize the  │
│                       │                │          │                                      │                                        │ second argument                                              │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2015-20107                   │
│                       ├────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2022-0391  │          │                                      │                                        │ python: urllib.parse does not sanitize URLs containing ASCII │
│                       │                │          │                                      │                                        │ newline and tabs                                             │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2022-0391                    │
├───────────────────────┼────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│ platform-python-devel │ CVE-2015-20107 │          │                                      │                                        │ python: mailcap: findmatch() function does not sanitize the  │
│                       │                │          │                                      │                                        │ second argument                                              │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2015-20107                   │
│                       ├────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2022-0391  │          │                                      │                                        │ python: urllib.parse does not sanitize URLs containing ASCII │
│                       │                │          │                                      │                                        │ newline and tabs                                             │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2022-0391                    │
├───────────────────────┼────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│ python3-libs          │ CVE-2015-20107 │          │                                      │                                        │ python: mailcap: findmatch() function does not sanitize the  │
│                       │                │          │                                      │                                        │ second argument                                              │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2015-20107                   │
│                       ├────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2022-0391  │          │                                      │                                        │ python: urllib.parse does not sanitize URLs containing ASCII │
│                       │                │          │                                      │                                        │ newline and tabs                                             │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2022-0391                    │
├───────────────────────┼────────────────┤          ├──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ python3-scipy         │ CVE-2021-20270 │          │ 1.0.0-21.module_el8.5.0+771+e5d9a225 │ 1.0.0-21.module+el8.5.0+10916+41bd434d │ python-pygments: Infinite loop in SML lexer may lead to DoS  │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2021-20270                   │
│                       ├────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2021-27291 │          │                                      │                                        │ python-pygments: ReDoS in multiple lexers                    │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2021-27291                   │
├───────────────────────┼────────────────┤          ├──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ python36              │ CVE-2021-20270 │          │ 3.6.8-38.module_el8.5.0+895+a459eca8 │ 3.6.8-38.module+el8.5.0+12207+5c5719bc │ python-pygments: Infinite loop in SML lexer may lead to DoS  │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2021-20270                   │
│                       ├────────────────┤          │                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2021-27291 │          │                                      │                                        │ python-pygments: ReDoS in multiple lexers                    │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2021-27291                   │
├───────────────────────┼────────────────┤          ├──────────────────────────────────────┼────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ sqlite-libs           │ CVE-2020-35527 │          │ 3.26.0-16.el8                        │ 3.26.0-16.el8_6                        │ sqlite: Out of bounds access during table rename             │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2020-35527                   │
│                       ├────────────────┼──────────┤                                      │                                        ├──────────────────────────────────────────────────────────────┤
│                       │ CVE-2020-35525 │ LOW      │                                      │                                        │ sqlite: Null pointer derreference in src/select.c            │
│                       │                │          │                                      │                                        │ https://avd.aquasec.com/nvd/cve-2020-35525                   │
└───────────────────────┴────────────────┴──────────┴──────────────────────────────────────┴────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

Python (python-pkg)
===================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 2)

┌───────────────────────────────────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│                      Library                      │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                             │
├───────────────────────────────────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ joblib (PKG-INFO)                                 │ CVE-2022-21797 │ CRITICAL │ 0.16.0            │ 1.2.0         │ The package joblib from 0 and before 1.2.0 are vulnerable to │
│                                                   │                │          │                   │               │ Arbitrary...                                                 │
│                                                   │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-21797                   │
├───────────────────────────────────────────────────┼────────────────┤          ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ scikit-learn (scikit_learn-0.19.1-py3.6.egg-info) │ CVE-2020-13092 │          │ 0.19.1            │ 0.23.1        │ ** DISPUTED ** scikit-learn (aka sklearn) through 0.23.0 can │
│                                                   │                │          │                   │               │ unseriali ...                                                │
│                                                   │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2020-13092                   │
│                                                   ├────────────────┼──────────┤                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                                                   │ CVE-2020-28975 │ HIGH     │                   │ 0.24.dev0     │ ** DISPUTED ** svm_predict_values in svm.cpp in Libsvm v324, │
│                                                   │                │          │                   │               │ as used in...                                                │
│                                                   │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2020-28975                   │
└───────────────────────────────────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

[mohag]

Red Hat rebuilt the stream8 container, so rebuilding this one now should help...

[porwalameet]

@mohag , @humblec
We ran trivy scan on latest cephcsi image, and still see a CRITICAL vulnerability being open from long time.

The vulnerability CVE-2022-21797 is still open. Is it possible we can patch base image and get this CVE fixed.

There was one upgrade to base image done in Feb 23, ceph/ceph-csi#3635, however this CVI is still open.

[porwalameet]

To add, base image from redhat stream 8 container, is updated: https://bugzilla.redhat.com/show_bug.cgi?id=2166562#c3 for 8stream

[porwalameet]

@mohag @humblec any update on this. We keep getting security warnings for the same.

[porwalameet]

@mohag @humblec, this CVE is getting highlighted. Is there any plan for fixing this?

[mohag]

CentOS Stream 8 is EoL soon.... (The images likely need to move to CentOS Stream 9 (or something else))

I suspect that the main problem is that Trivy uses the RHEL vulnerability database for CentOS Stream and that the package versions no longer align closely enough. (The fixes for RHEL may / may not exist for CentOS Stream as well it seems) See Q4 here

Trivy has a PR for CentOS Stream support

The rebuilds of the base container only helps if these containers are rebuilt after the base image has been updated... I'm not sure if there are scheduled rebuilds or if they are only build on new releases. (and looking at the CentOS FAQ and Trivy issues about CentOS Stream, it seems like an up to date CentOS Stream might still contain vulnerabilities that is fixed in RHEL)

[porwalameet]

Yes, up to date CentOS stream might contain some vulnerabilities. However, these are incrementally fixed. Following same procedure, for other repos. as base image is updated, previously known vulnerabilities will be patched.

Any timeline for moving to CentOS Stream 9?

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[Starttoaster]

I'd like this Issue to remain open while the Ceph image still reports a critical level vulnerability.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[Starttoaster]

bump

[humblec]

@ktdreyer any help to take care of this from base container pov ?

[Starttoaster]

Fwiw, I'm coming from a place here where I would like to help with fixing this. At least for the Critical level Joblib vulnerability which is resolved in Joblib 1.2.0. But I don't know much about Joblib, how its introduced in the ceph image, or what issues could arise from upgrading it to 1.2.0 from what appears to be installed in the container (0.16.0). But it would be excellent to take care of this if we can, Ceph is a critical piece of infrastructure to many, and it would be sad to see it go unmaintained

So if the maintainer team doesn't have resources for fixing this, maybe they have resources to guide me into fixing it for them?

This screenshot is from my k8s cluster vulnerability scanner dashboard, and is for the ceph-csi image which uses the image from this repository as a base

@humblec fwiw I think the Medium and Low severity vulnerabilities from this screenshot are probably actually introduced in the ceph-csi image.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[Starttoaster]

Not stale. These stale Issue notifications are pretty annoying to be honest. I'll just keep re-upping this Issue as long as I am alive 😄