Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix security vulnerabilities #71

Open
mmalvik opened this issue Feb 13, 2024 · 1 comment
Open

Fix security vulnerabilities #71

mmalvik opened this issue Feb 13, 2024 · 1 comment

Comments

@mmalvik
Copy link

mmalvik commented Feb 13, 2024

Currently the image groundnuty/k8s-wait-for:no-root-v2.0 has several security vulnerabilities.

Running the command docker scout cves groundnuty/k8s-wait-for:no-root-v2.0 list all of these.
Here is the summary at the end:

67 vulnerabilities found in 8 packages
  LOW       5
  MEDIUM    30
  HIGH      29
  CRITICAL  3

The Trivy scan for this repo has been failing for some time too:
https://github.com/groundnuty/k8s-wait-for/actions/workflows/trivy.yml 💥

I have not looked into this in depth, but maybe the older image of alpine is a part of this?
FROM alpine:3.16.2

@AnthonyDewhirst
Copy link

I too have come to this page because of the above.
Is the repo being maintained? Do you have alternatives now? (trying to find the KEP for this: kubernetes/kubernetes#106802)
When Trivy runs, a lot of the issues stem from Curl. Looking at the code, Curl is only used during image creation as far as I can tell. Couldn't we then just remove curl from the image? (haven't looked at all of the security details yet)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants