CVE-2023-48795

[adit-cmd]

Hi,
Has anyone come across the vulnerability CVE-2023-48795 ( https://nvd.nist.gov/vuln/detail/CVE-2023-48795 )? Does it affect the cas? The current version I am running is cluster-autoscaler:v1.29.0. I did download the docker image locally and did an inspect but I do not see any openssh related packages. It would be great if someone can comment on this vulnerability?

[Shubham82]

Hi @adit-cmd

This vulnerability is resolved in CA 1.30.0, the related package was golang.org/x/crypto. I checked the vulnerability for CA 1.30.0 image here is the output for it (used trivy for scanning):

┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH     │ fixed  │ v0.42.0           │ 0.46.0        │ opentelemetry-go-contrib: DoS vulnerability in otelgrpc due │
│ rg/grpc/otelgrpc                                             │                │          │        │                   │               │ to unbound cardinality metrics                              │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-47108                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[Shubham82]

Also, issue #5343 opened for the vulnerabilities in the CA.
Please have a look.

[Shubham82]

@adit-cmd, if your concern is resolved so can we close this issue?

[Shubham82]

Closing this issue, Please reopen this issue if there is any concern.

/close

[k8s-ci-robot]

@Shubham82: Closing this issue.

In response to this:

Closing this issue, Please reopen this issue if there is any concern.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.