Vulnerability patch for images 2.8.1, 2.9.2

[shahriak]

Hello,

I am seeing a lot of vulnerabilities in the images of 2.8.1 and even the latest version of Linkerd 2.9.2. Below is an example:

How do we rebuild the images to tackle these vulnerabilities? Currently we are getting flagged for these..

2021-02-12T16:07:50.784-0800	�[34mINFO�[0m	Detecting Debian vulnerabilities...
2021-02-12T16:07:50.790-0800	�[34mINFO�[0m	Trivy skips scanning programming language libraries because no supported file was detected

ghcr.io/linkerd/proxy:stable-2.9.2 (debian 10.4)
================================================
Total: 98 (UNKNOWN: 0, LOW: 63, MEDIUM: 11, HIGH: 24, CRITICAL: 0)

+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
|    LIBRARY     |  VULNERABILITY ID   | SEVERITY | INSTALLED VERSION |   FIXED VERSION   |                           TITLE                            |
+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
| apt            | CVE-2020-27350      | MEDIUM   | 1.8.2.1           | 1.8.2.2           | APT had several integer                                    |
|                |                     |          |                   |                   | overflows and underflows while                             |
|                |                     |          |                   |                   | parsing .deb packages, aka...                              |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2020-27350                      |
+                +---------------------+----------+                   +-------------------+------------------------------------------------------------+
|                | CVE-2011-3374       | LOW      |                   |                   | It was found that apt-key in apt,                          |
|                |                     |          |                   |                   | all versions, do not correctly...                          |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2011-3374                       |
+----------------+---------------------+          +-------------------+-------------------+------------------------------------------------------------+
| bash           | CVE-2019-18276      |          | 5.0-4             |                   | bash: when effective UID is not                            |
|                |                     |          |                   |                   | equal to its real UID the...                               |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2019-18276                      |
+                +---------------------+          +                   +-------------------+------------------------------------------------------------+
|                | TEMP-0841856-B18BAF |          |                   |                   | -->security-tracker.debian.org/tracker/TEMP-0841856-B18BAF |
+----------------+---------------------+          +-------------------+-------------------+------------------------------------------------------------+
| coreutils      | CVE-2016-2781       |          | 8.30-3            |                   | coreutils: Non-privileged                                  |
|                |                     |          |                   |                   | session can escape to the                                  |
|                |                     |          |                   |                   | parent session in chroot                                   |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2016-2781                       |
+                +---------------------+          +                   +-------------------+------------------------------------------------------------+
|                | CVE-2017-18018      |          |                   |                   | coreutils: race condition                                  |
|                |                     |          |                   |                   | vulnerability in chown and chgrp                           |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2017-18018                      |
+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
| gcc-8-base     | CVE-2018-12886      | HIGH     | 8.3.0-6           |                   | gcc: spilling of stack                                     |
|                |                     |          |                   |                   | protection address in cfgexpand.c                          |
|                |                     |          |                   |                   | and function.c leads to...                                 |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2018-12886                      |
+                +---------------------+          +                   +-------------------+------------------------------------------------------------+
|                | CVE-2019-15847      |          |                   |                   | gcc: POWER9 "DARN" RNG intrinsic                           |
|                |                     |          |                   |                   | produces repeated output                                   |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2019-15847                      |
+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
| gpgv           | CVE-2019-14855      | LOW      | 2.2.12-1+deb10u1  |                   | gnupg2: OpenPGP Key Certification                          |
|                |                     |          |                   |                   | Forgeries with SHA-1                                       |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2019-14855                      |
+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
| libapt-pkg5.0  | CVE-2020-27350      | MEDIUM   | 1.8.2.1           | 1.8.2.2           | APT had several integer                                    |
|                |                     |          |                   |                   | overflows and underflows while                             |
|                |                     |          |                   |                   | parsing .deb packages, aka...                              |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2020-27350                      |
+                +---------------------+----------+                   +-------------------+------------------------------------------------------------+
|                | CVE-2011-3374       | LOW      |                   |                   | It was found that apt-key in apt,                          |
|                |                     |          |                   |                   | all versions, do not correctly...                          |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2011-3374                       |
+----------------+---------------------+----------+-------------------+-------------------+------------------------------------------------------------+
| libc-bin       | CVE-2020-1751       | HIGH     | 2.28-10           |                   | glibc: array overflow in                                   |
|                |                     |          |                   |                   | backtrace functions for powerpc                            |
|                |                     |          |                   |                   | -->avd.aquasec.com/nvd/cve-2020-1751                       |
+                +---------------------+          +                   +-------------------+------------------------------------------------------------+

[shahriak]

Can someone help with this?

[kleimkuhler]

Hey @shahriak sorry for the silence here! We'll be releasing a stable-2.9.4 this week and it will include a bump in the base images: #5794.

[shahriak]

Great, thank you!

[kleimkuhler]

@shahriak No problem! stable-2.9.4 was released by the way; meant to give you an update here.