Docker Container Image Vulnerability Check - 2021-07-30

[chirangaalwis]

Is this a BUG REPORT or FEATURE REQUEST?

It is a BUG REPORT.

Choose one: BUG REPORT or FEATURE REQUEST

What happened:
Experienced the following Docker container image vulnerability scan report using Trivy Docker image scan tool.

2021-07-29T13:38:11.2187979Z 2021-07-29T13:38:11.217Z	�[34mINFO�[0m	Detecting Alpine vulnerabilities...
2021-07-29T13:38:11.2203896Z 2021-07-29T13:38:11.219Z	�[34mINFO�[0m	Number of language-specific files: 6
2021-07-29T13:38:11.2204899Z 2021-07-29T13:38:11.219Z	�[34mINFO�[0m	Detecting gobinary vulnerabilities...
2021-07-29T13:38:11.2238865Z 
2021-07-29T13:38:11.2240010Z litmuschaos/go-runner:1.13.8 (alpine 3.13.5)
2021-07-29T13:38:11.2240527Z ============================================
2021-07-29T13:38:11.2241005Z Total: 4 (MEDIUM: 4, HIGH: 0, CRITICAL: 0)
2021-07-29T13:38:11.2241273Z 
2021-07-29T13:38:11.2241988Z +---------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2242686Z | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
2021-07-29T13:38:11.2249533Z +---------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2250760Z | curl    | CVE-2021-22922   | MEDIUM   | 7.77.0-r1         | 7.78.0-r0     | curl: wrong content via               |
2021-07-29T13:38:11.2251494Z |         |                  |          |                   |               | metalink is not being discarded       |
2021-07-29T13:38:11.2252376Z |         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-22922 |
2021-07-29T13:38:11.2258617Z +         +------------------+          +                   +               +---------------------------------------+
2021-07-29T13:38:11.2259705Z |         | CVE-2021-22923   |          |                   |               | curl: Metalink download               |
2021-07-29T13:38:11.2260431Z |         |                  |          |                   |               | sends credentials                     |
2021-07-29T13:38:11.2261312Z |         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-22923 |
2021-07-29T13:38:11.2262202Z +---------+------------------+          +                   +               +---------------------------------------+
2021-07-29T13:38:11.2263646Z | libcurl | CVE-2021-22922   |          |                   |               | curl: wrong content via               |
2021-07-29T13:38:11.2264530Z |         |                  |          |                   |               | metalink is not being discarded       |
2021-07-29T13:38:11.2266854Z |         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-22922 |
2021-07-29T13:38:11.2267787Z +         +------------------+          +                   +               +---------------------------------------+
2021-07-29T13:38:11.2268713Z |         | CVE-2021-22923   |          |                   |               | curl: Metalink download               |
2021-07-29T13:38:11.2269432Z |         |                  |          |                   |               | sends credentials                     |
2021-07-29T13:38:11.2270307Z |         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-22923 |
2021-07-29T13:38:11.2271190Z +---------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2281737Z 
2021-07-29T13:38:11.2282206Z litmus/experiments (gobinary)
2021-07-29T13:38:11.2283921Z =============================
2021-07-29T13:38:11.2285690Z Total: 6 (MEDIUM: 5, HIGH: 1, CRITICAL: 0)
2021-07-29T13:38:11.2286966Z 
2021-07-29T13:38:11.2298684Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2299650Z |       LIBRARY       | VULNERABILITY ID | SEVERITY |         INSTALLED VERSION          |           FIXED VERSION            |                 TITLE                 |
2021-07-29T13:38:11.2300824Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2302017Z | golang.org/x/crypto | CVE-2020-29652   | HIGH     | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f | golang: crypto/ssh: crafted           |
2021-07-29T13:38:11.2303163Z |                     |                  |          |                                    |                                    | authentication request can            |
2021-07-29T13:38:11.2313693Z |                     |                  |          |                                    |                                    | lead to nil pointer dereference       |
2021-07-29T13:38:11.2321287Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-29652 |
2021-07-29T13:38:11.2326877Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2328245Z | k8s.io/client-go    | CVE-2019-11250   | MEDIUM   | v0.0.0-20191016111102-bec269661e48 | v0.17.0                            | kubernetes: Bearer tokens             |
2021-07-29T13:38:11.2329152Z |                     |                  |          |                                    |                                    | written to logs at high               |
2021-07-29T13:38:11.2329965Z |                     |                  |          |                                    |                                    | verbosity levels (>= 7)...            |
2021-07-29T13:38:11.2331034Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2019-11250 |
2021-07-29T13:38:11.2332103Z +                     +------------------+          +                                    +------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2333210Z |                     | CVE-2020-8565    |          |                                    | v0.20.0-alpha.2                    | kubernetes: Incomplete fix            |
2021-07-29T13:38:11.2334349Z |                     |                  |          |                                    |                                    | for CVE-2019-11250 allows for         |
2021-07-29T13:38:11.2335176Z |                     |                  |          |                                    |                                    | token leak in logs when...            |
2021-07-29T13:38:11.2336236Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-8565  |
2021-07-29T13:38:11.2337300Z +---------------------+------------------+          +------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2338438Z | k8s.io/kubernetes   | CVE-2020-8554    |          | v1.17.3                            |                                    | kubernetes: MITM using                |
2021-07-29T13:38:11.2339313Z |                     |                  |          |                                    |                                    | LoadBalancer or ExternalIPs           |
2021-07-29T13:38:11.2340335Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-8554  |
2021-07-29T13:38:11.2341370Z +                     +------------------+          +                                    +------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2342594Z |                     | CVE-2020-8564    |          |                                    | v1.20.0-alpha.1                    | kubernetes: Docker config             |
2021-07-29T13:38:11.2343455Z |                     |                  |          |                                    |                                    | secrets leaked when file is           |
2021-07-29T13:38:11.2344213Z |                     |                  |          |                                    |                                    | malformed and loglevel >=...          |
2021-07-29T13:38:11.2345372Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-8564  |
2021-07-29T13:38:11.2346386Z +                     +------------------+          +                                    +------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2347530Z |                     | CVE-2020-8565    |          |                                    | v1.20.0-alpha.2                    | kubernetes: Incomplete fix            |
2021-07-29T13:38:11.2348668Z |                     |                  |          |                                    |                                    | for CVE-2019-11250 allows for         |
2021-07-29T13:38:11.2349597Z |                     |                  |          |                                    |                                    | token leak in logs when...            |
2021-07-29T13:38:11.2350662Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-8565  |
2021-07-29T13:38:11.2351720Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2352216Z 
2021-07-29T13:38:11.2352554Z litmus/helpers (gobinary)
2021-07-29T13:38:11.2352936Z =========================
2021-07-29T13:38:11.2353327Z Total: 3 (MEDIUM: 2, HIGH: 1, CRITICAL: 0)
2021-07-29T13:38:11.2353561Z 
2021-07-29T13:38:11.2354314Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2355097Z |       LIBRARY       | VULNERABILITY ID | SEVERITY |         INSTALLED VERSION          |           FIXED VERSION            |                 TITLE                 |
2021-07-29T13:38:11.2356111Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2357216Z | golang.org/x/crypto | CVE-2020-29652   | HIGH     | v0.0.0-20200622213623-75b288015ac9 | v0.0.0-20201216223049-8b5274cf687f | golang: crypto/ssh: crafted           |
2021-07-29T13:38:11.2358054Z |                     |                  |          |                                    |                                    | authentication request can            |
2021-07-29T13:38:11.2358810Z |                     |                  |          |                                    |                                    | lead to nil pointer dereference       |
2021-07-29T13:38:11.2359826Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-29652 |
2021-07-29T13:38:11.2360890Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2362046Z | k8s.io/client-go    | CVE-2019-11250   | MEDIUM   | v0.0.0-20191016111102-bec269661e48 | v0.17.0                            | kubernetes: Bearer tokens             |
2021-07-29T13:38:11.2362932Z |                     |                  |          |                                    |                                    | written to logs at high               |
2021-07-29T13:38:11.2363734Z |                     |                  |          |                                    |                                    | verbosity levels (>= 7)...            |
2021-07-29T13:38:11.2364792Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2019-11250 |
2021-07-29T13:38:11.2365855Z +                     +------------------+          +                                    +------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2367118Z |                     | CVE-2020-8565    |          |                                    | v0.20.0-alpha.2                    | kubernetes: Incomplete fix            |
2021-07-29T13:38:11.2368252Z |                     |                  |          |                                    |                                    | for CVE-2019-11250 allows for         |
2021-07-29T13:38:11.2369020Z |                     |                  |          |                                    |                                    | token leak in logs when...            |
2021-07-29T13:38:11.2370095Z |                     |                  |          |                                    |                                    | -->avd.aquasec.com/nvd/cve-2020-8565  |
2021-07-29T13:38:11.2371109Z +---------------------+------------------+----------+------------------------------------+------------------------------------+---------------------------------------+
2021-07-29T13:38:11.2371520Z 
2021-07-29T13:38:11.2371844Z usr/local/bin/dns_interceptor (gobinary)
2021-07-29T13:38:11.2372217Z ========================================
2021-07-29T13:38:11.2372625Z Total: 0 (MEDIUM: 0, HIGH: 0, CRITICAL: 0)
2021-07-29T13:38:11.2372860Z 
2021-07-29T13:38:11.2372987Z 
2021-07-29T13:38:11.2373292Z usr/local/bin/nsutil (gobinary)
2021-07-29T13:38:11.2373645Z ===============================
2021-07-29T13:38:11.2374034Z Total: 0 (MEDIUM: 0, HIGH: 0, CRITICAL: 0)
2021-07-29T13:38:11.2374253Z 
2021-07-29T13:38:11.2374382Z 
2021-07-29T13:38:11.2374690Z usr/local/bin/promql (gobinary)
2021-07-29T13:38:11.2375043Z ===============================
2021-07-29T13:38:11.2375434Z Total: 1 (MEDIUM: 1, HIGH: 0, CRITICAL: 0)
2021-07-29T13:38:11.2375651Z 
2021-07-29T13:38:11.2376319Z +------------------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2376984Z |     LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
2021-07-29T13:38:11.2377838Z +------------------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2378759Z | gopkg.in/yaml.v2 | CVE-2019-11254   | MEDIUM   | v2.2.2            | v2.2.8        | kubernetes: Denial of                 |
2021-07-29T13:38:11.2379460Z |                  |                  |          |                   |               | service in API server via             |
2021-07-29T13:38:11.2380098Z |                  |                  |          |                   |               | crafted YAML payloads by...           |
2021-07-29T13:38:11.2380965Z |                  |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2019-11254 |
2021-07-29T13:38:11.2381832Z +------------------+------------------+----------+-------------------+---------------+---------------------------------------+
2021-07-29T13:38:11.2382167Z 
2021-07-29T13:38:11.2382625Z usr/local/bin/pumba (gobinary)
2021-07-29T13:38:11.2382980Z ==============================
2021-07-29T13:38:11.2383371Z Total: 1 (MEDIUM: 0, HIGH: 1, CRITICAL: 0)
2021-07-29T13:38:11.2383637Z 
2021-07-29T13:38:11.2384371Z +--------------------------+------------------+----------+-------------------+---------------+--------------------------------------+
2021-07-29T13:38:11.2385098Z |         LIBRARY          | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                TITLE                 |
2021-07-29T13:38:11.2386035Z +--------------------------+------------------+----------+-------------------+---------------+--------------------------------------+
2021-07-29T13:38:11.2386990Z | github.com/gogo/protobuf | CVE-2021-3121    | HIGH     | v1.3.1            | v1.3.2        | gogo/protobuf:                       |
2021-07-29T13:38:11.2387807Z |                          |                  |          |                   |               | plugin/unmarshal/unmarshal.go        |
2021-07-29T13:38:11.2388620Z |                          |                  |          |                   |               | lacks certain index validation       |
2021-07-29T13:38:11.2389519Z |                          |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-3121 |
2021-07-29T13:38:11.2390407Z +--------------------------+------------------+----------+-------------------+---------------+--------------------------------------+
2021-07-29T13:38:11.3867958Z Vulnerabilities found.
2021-07-29T13:38:11.3898449Z ##[error]Bash exited with code '1'.
2021-07-29T13:38:11.3947357Z ##[section]Finishing: Scan Docker container image

What you expected to happen:
Since, maintenance of a tested version of go-runner Docker container image in a user specific, private container registry is a best practice in a production grade container deployment (instead of using the publicly available version from a public image registry), it would be ideal to provide the users with an image which is vulnerability free, as much as possible.

Appreciate if you could look into the detected vulnerabilities. If LitmusChaos uses a different, image scan tool, would appreciate details about its vulnerability check.

How to reproduce it (as minimally and precisely as possible):
Using Trivy Docker image scan tool.

[ksatchit]

Thanks for opening the issue . We are in the process of hardening the images - with mitigation for at least severity high CVEs as much as possible. Eta will be updated here (expected to take some time due to test efforts involved)

[ispeakc0de]

We have created a separate issue to track the vulnerabilities s closing this issue - #510