Advisories for latest node-problem-detector version

[pdeslaur]

We picked up version 0.8.14, which fixes a few true positives we've been tracking: wolfi-dev/os#4840

Note that CVE-2020-8565 is now incorrectly reported on our package. Per k8s, Kubernetes is affected until v1.17.13, and our newer version of the package is now at v1.17.17 (reported as v0.17.17 b/c that's how the library version is setup)

It'd be great to encode more information in our future of advisories.

wolfictl scan =(curl -sL https://packages.wolfi.dev/os/x86_64/node-problem-detector-0.8.14-r0.apk)
Will process: zshuRKwOc
└── 📄 /usr/bin/node-problem-detector
        📦 k8s.io/client-go v0.17.17 (go-module)
            Medium CVE-2020-8565 GHSA-8cfg-vx93-jvxw fixed in 0.20.0-alpha.2

[luhring]

It'd be great to encode more information in our future of advisories.

What did you have in mind?

[pdeslaur]

What did you have in mind?

I considered adding prose to the fixed status to indicate this vulnerability is displayed as a false positive, even after the fix is applied. Maybe it's already implicit in the fixed status.

[luhring]

I considered adding prose to the fixed status to indicate this vulnerability is displayed as a false positive, even after the fix is applied. Maybe it's already implicit in the fixed status.

Yeah, if I'm understanding the situation correctly, I think there's nothing more we can/should do there. This would be a bug in the scanner