Image scan has detect several vulnerabilites in vertical-pod-autoscaler

[albertschwarzkopf]

Hi,

trivy image scanner has detect several vulnerabilites in vertical-pod-autoscaler in the latest images. Could you please fix the "HIGH" vulnerabilities?

I think the report is the same for all images:

k8s.gcr.io/autoscaling/vpa-admission-controller:0.10.0
k8s.gcr.io/autoscaling/vpa-recommender:0.10.0
k8s.gcr.io/autoscaling/vpa-updater:0.10.0

E.g.:

trivy image k8s.gcr.io/autoscaling/vpa-admission-controller:0.10.0
2022-02-25T09:51:33.315+0100	INFO	Detected OS: debian
2022-02-25T09:51:33.315+0100	INFO	Detecting Debian vulnerabilities...
2022-02-25T09:51:33.316+0100	INFO	Number of language-specific files: 1
2022-02-25T09:51:33.316+0100	INFO	Detecting gobinary vulnerabilities...

k8s.gcr.io/autoscaling/vpa-admission-controller:0.10.0 (debian 11.2)
====================================================================
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)


admission-controller (gobinary)
===============================
Total: 4 (UNKNOWN: 1, LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 0)

+--------------------------+------------------+----------+-------------------+----------------+---------------------------------------+
|         LIBRARY          | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION  |                 TITLE                 |
+--------------------------+------------------+----------+-------------------+----------------+---------------------------------------+
| github.com/gogo/protobuf | CVE-2021-3121    | HIGH     | v1.3.1            | 1.3.2          | gogo/protobuf:                        |
|                          |                  |          |                   |                | plugin/unmarshal/unmarshal.go         |
|                          |                  |          |                   |                | lacks certain index validation        |
|                          |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-3121  |
+--------------------------+------------------+          +-------------------+----------------+---------------------------------------+
| golang.org/x/text        | CVE-2020-14040   |          | v0.3.2            | 0.3.3          | golang.org/x/text: possibility        |
|                          |                  |          |                   |                | to trigger an infinite loop in        |
|                          |                  |          |                   |                | encoding/unicode could lead to...     |
|                          |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2020-14040 |
+                          +------------------+----------+                   +----------------+---------------------------------------+
|                          | CVE-2021-38561   | UNKNOWN  |                   | 0.3.7          | Due to improper index calculation,    |
|                          |                  |          |                   |                | an incorrectly formatted              |
|                          |                  |          |                   |                | language tag can cause...             |
|                          |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2021-38561 |
+--------------------------+------------------+----------+-------------------+----------------+---------------------------------------+
| k8s.io/client-go         | CVE-2020-8565    | MEDIUM   | v0.18.3           | 0.20.0-alpha.2 | kubernetes: Incomplete fix            |
|                          |                  |          |                   |                | for CVE-2019-11250 allows for         |
|                          |                  |          |                   |                | token leak in logs when...            |
|                          |                  |          |                   |                | -->avd.aquasec.com/nvd/cve-2020-8565  |
+--------------------------+------------------+----------+-------------------+----------------+---------------------------------------+

[sebastien-prudhomme]

Hi @albertschwarzkopf, I know that several of the charts have some security issues.

See also there: https://artifacthub.io/packages/helm/cowboysysop/vertical-pod-autoscaler?modal=security-report

I've seen that you opened an issue on the project: kubernetes/autoscaler#4715

As soon as they released new images I try to update the chart in a few days.