Keda 2.13.1 Sysdig scan Vulnerabilities CVE-2024-27304 CVE-2024-24786 CVE-2024-28110 CVE-2024-28180

[amardeep2006]

Report

I scanned keda v 2.13.1 and see following in report.

CVE-2024-27304 in github.com/jackc/pgx/v5 - v5.5.2
CVE-2024-24786 in google.golang.org/protobuf - v1.32.0
CVE-2024-28110 in github.com/cloudevents/sdk-go/v2 - v2.14.0
CVE-2024-28180 in github.com/go-jose/go-jose/v3 - v3.0.1

Expected Behavior

There should be no vulnerability if affected packages are bumped up.

Actual Behavior

Sysdig scan fails.

Steps to Reproduce the Problem

Standard scan

Logs from KEDA operator

example

KEDA Version

2.13.1

Kubernetes Version

None

Platform

None

Scaler Details

No response

Anything else?

No response

[JorTurFer]

Hello @amardeep2006 ,
Thanks for reporting! We don't have plans for any hotfix release for versions v2.13 as the v2.14 will be released this month. Some of the issues are already solved in main (such us this) but it'd be nice if you can test main tag to double check if there are still present on that version.

[amardeep2006]

Thanks @JorTurFer . I did a rescan of main tag and CVE-2024-28180 in github.com/go-jose/go-jose/v3 - v3.0.1 is fixed.

Here are the Vulnerabilities that still needs to be looked into :

GHSA-mrww-27vc-gghv in github.com/jackc/pgx/v5 - v5.5.2
GHSA-8r3f-844c-mc37 in google.golang.org/protobuf - v1.32.0
GHSA-5pf6-2qwx-pxm2 in github.com/cloudevents/sdk-go/v2 - v2.14.0

[amardeep2006]

keda-metrics-apiserver also needs some dependency bump .

GHSA-mrww-27vc-gghv in github.com/jackc/pgx/v5 - v5.5.2
GHSA-8r3f-844c-mc37 in google.golang.org/protobuf - v1.32.0

[zroubalik]

Thanks for reporting, let's mitigate these in 2.14

[amardeep2006]

I am closing this issue as KEDA 2.14.0 has passed the scan. I highly appreciate the remediation. Thanks a lot for the awesome project.

[JorTurFer]

I am closing this issue as KEDA 2.14.0 has passed the scan. I highly appreciate the remediation. Thanks a lot for the awesome project.

Thank you for checking it and reporting the feedback too! ❤️