Repository navigation
Remove some vulnerabilities from go modules #4506
Description
Activity
@EXPEbdodla Let me use this opportunity to involve you here. So far we have been steering clear of the go codebase as (at least my) assumption is that the best path forward would be to upstream the changes from your fork instead of diverging in any way. I realize we have never really discussed that though 😄 Is upstreaming also what you're working towards?
Reacted by Shuchu Han@EXPEbdodla which version did you check for this list of Vulns? in the latest version (0.40.1) , I didn't see this package
github.com/gogo/protobuf v1.2.1We are using
google.golang.org/protobuf v1.34.2version.@tokoko We can do that. But we have a backlog item for using endpoint from feature_store.yaml for transformation server calls. Once we fix that, we can do that. And we also use Datadog for our monitoring. It's added in code. Easy to resolve.
Reacted by Shuchu Hansorry, It seems I asked a wrong person about the question.... .my bad. @EXPEbdodla. Apologize about this.
@brijesh-vora-sp which Feast version are you using for build the materialization engine?Ok, so I cloned the repo and created docker image on master (e675cbd) 09/23. Checked vulnerabilities again. Here are the updated ones:
<style> </style>Severity ExPRT rating CVE ID CVSS score Package name & version Layer command Medium Medium CVE-2024-8096 6.5 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-28320 5.9 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Medium CVE-2024-2379 5.4 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2021-22922 6.5 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-23915 6.5 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2021-22923 5.3 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Low CVE-2023-23914 9.1 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Medium CVE-2023-46219 5.3 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Medium CVE-2022-43551 7.5 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-42916 7.5 curl 7.74.0-1.3+deb11u13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2018-1000021 8.8 git 1:2.30.2-1+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2024-32020 3.9 git 1:2.30.2-1+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-24975 7.5 git 1:2.30.2-1+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-4641 5.5 shadow 1:4.8.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Medium CVE-2023-29383 3.3 shadow 1:4.8.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2013-4235 4.7 shadow 1:4.8.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2019-19882 7.8 shadow 1:4.8.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2007-5686 4.9 shadow 1:4.8.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Medium CVE-2023-4039 4.8 gcc-10 10.2.1-6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-1304 7.8 e2fsprogs 1.46.2-2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-3715 7.8 bash 5.1-2+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Medium CVE-2024-26458 8.6 krb5 1.18.3-6+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2018-5709 7.5 krb5 1.18.3-6+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2024-26461 7.5 krb5 1.18.3-6+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Medium CVE-2024-22365 5.5 pam 1.4.0-9+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Low CVE-2019-8457 9.8 db5.3 5.3.28+dfsg1-0.8 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2011-4116 7.5 perl 5.32.1-4+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Medium CVE-2020-16156 7.8 perl 5.32.1-4+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2023-31486 8.1 perl 5.32.1-4+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2023-31484 8.1 perl 5.32.1-4+deb11u3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Medium CVE-2023-45918 8.8 ncurses 6.2+20201114-2+deb11u2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-50495 6.5 ncurses 6.2+20201114-2+deb11u2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2005-2541 10 tar 1.34+dfsg-1+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Medium CVE-2023-4039 4.8 gcc-9 9.3.0-22 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2015-3276 7.5 openldap 2.4.57+dfsg-3+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2017-17740 7.5 openldap 2.4.57+dfsg-3+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2017-14159 4.7 openldap 2.4.57+dfsg-3+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2020-15719 4.2 openldap 2.4.57+dfsg-3+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2023-2953 7.5 openldap 2.4.57+dfsg-3+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2021-36690 7.5 sqlite3 3.34.1-3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2023-7104 7.3 sqlite3 3.34.1-3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2021-31239 7.5 sqlite3 3.34.1-3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2021-45346 4.3 sqlite3 3.34.1-3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-35737 7.5 sqlite3 3.34.1-3 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2022-0563 5.5 util-linux 2.36.1-8+deb11u2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2016-2781 6.5 coreutils 8.32-4 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2017-18018 4.7 coreutils 8.32-4 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2019-9192 7.5 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2018-20796 7.5 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2019-1010024 5.3 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2019-1010025 5.3 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Low CVE-2019-1010022 9.8 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-4813 5.9 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2019-1010023 5.4 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-4806 5.9 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2010-4756 4 glibc 2.31-13+deb11u11 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-28182 5.3 nghttp2 1.43.0-1+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium High CVE-2011-3389 4.3 gnutls28 3.7.1-5+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-28835 5 gnutls28 3.7.1-5+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-28834 5.3 gnutls28 3.7.1-5+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2021-36086 3.3 libsepol 3.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2021-36084 3.3 libsepol 3.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2021-36087 3.3 libsepol 3.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2021-36085 3.3 libsepol 3.1-1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2020-13529 6.1 systemd 247.3-7+deb11u6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-31439 5.3 systemd 247.3-7+deb11u6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-31438 5.3 systemd 247.3-7+deb11u6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2013-4392 3.3 systemd 247.3-7+deb11u6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-31437 5.3 systemd 247.3-7+deb11u6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2017-11164 7.5 pcre3 2:8.39-13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2017-7246 7.8 pcre3 2:8.39-13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2017-7245 7.8 pcre3 2:8.39-13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2017-16231 5.5 pcre3 2:8.39-13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2019-20838 7.5 pcre3 2:8.39-13 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2011-3374 3.7 apt 2.2.4 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-52426 5.5 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2013-0340 6.8 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Medium CVE-2024-45491 9.8 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2023-52425 7.5 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2024-28757 7.5 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Medium CVE-2024-45492 9.8 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Medium CVE-2024-45490 9.8 expat 2.2.10-2+deb11u5 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-0727 5.5 openssl 1.1.1w-0+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical High CVE-2024-5535 9.1 openssl 1.1.1w-0+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2024-2511 3.7 openssl 1.1.1w-0+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-4741 5.6 openssl 1.1.1w-0+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2023-5678 5.3 openssl 1.1.1w-0+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2018-6829 7.5 libgcrypt20 1.8.7-6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2021-33560 7.5 libgcrypt20 1.8.7-6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Medium Low CVE-2024-2236 5.9 libgcrypt20 1.8.7-6 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Low Low CVE-2022-3219 3.3 gnupg2 2.2.27-2+deb11u2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit Critical Low CVE-2023-45853 9.8 zlib 1:1.2.11.dfsg-2+deb11u2 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-41409 7.5 pcre2 10.36-2+deb11u1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High Low CVE-2022-4899 7.5 libzstd 1.4.8+dfsg-2.1 RUN /bin/sh -c apt-get update && apt-get install --no-install-suggests --no-install-recommends --yes git %23 buildkit High High CVE-2024-6345 8.8 setuptools 65.5.1 RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get update; apt-get install -y --no-install-recommends dpkg-dev gcc gnupg libbluetooth-dev libbz2-dev libc6-dev libdb-dev libexpat1-dev libffi-dev libgdbm-dev liblzma-dev libncursesw5-dev libreadline-dev libsqlite3-dev libssl-dev make tk-dev uuid-dev wget xz-utils zlib1g-dev ; wget -O python.tar.xz "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz"; wget -O python.tar.xz.asc "https://www.python.org/ftp/python/${PYTHON_VERSION%%[a-z]*}/Python-$PYTHON_VERSION.tar.xz.asc"; GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$GPG_KEY"; gpg --batch --verify python.tar.xz.asc python.tar.xz; gpgconf --kill all; rm -rf "$GNUPGHOME" python.tar.xz.asc; mkdir -p /usr/src/python; tar --extract --directory /usr/src/python --strip-components=1 --file python.tar.xz; rm python.tar.xz; cd /usr/src/python; gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; ./configure --build="$gnuArch" --enable-loadable-sqlite-extensions --enable-optimizations --enable-option-checking=fatal --enable-shared --with-lto --with-system-expat --with-ensurepip ; nproc="$(nproc)"; EXTRA_CFLAGS="$(dpkg-buildflags --get CFLAGS)"; LDFLAGS="$(dpkg-buildflags --get LDFLAGS)"; LDFLAGS="${LDFLAGS:--Wl}%2C--strip-all"; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:-}" "PROFILE_TASK=${PROFILE_TASK:-}" ; rm python; make -j "$nproc" "EXTRA_CFLAGS=${EXTRA_CFLAGS:-}" "LDFLAGS=${LDFLAGS:--Wl}%2C-rpath='$$ORIGIN/../lib'" "PROFILE_TASK=${PROFILE_TASK:-}" python ; make install; cd /; rm -rf /usr/src/python; find /usr/local -depth ( ( -type d -a ( -name test -o -name tests -o -name idle_test ) ) -o ( -type f -a ( -name '.pyc' -o -name '.pyo' -o -name 'libpython*.a' ) ) ) -exec rm -rf '{}' + ; ldconfig; apt-mark auto '.' > /dev/null; apt-mark manual $savedAptMark; find /usr/local -type f -executable -not ( -name 'tkinter' ) -exec ldd '{}' ';' | awk '/=>/ { so = $(NF-1); if (index(so%2C "/usr/local/") == 1) { next }; gsub("^/(usr/)?"%2C ""%2C so); printf "%s\n"%2C so }' | sort -u | xargs -r dpkg-query --search | cut -d: -f1 | sort -u | xargs -r apt-mark manual ; apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false; rm -rf /var/lib/apt/lists/*; export PYTHONDONTWRITEBYTECODE=1; python3 --version; pip3 install --disable-pip-version-check --no-cache-dir --no-compile 'setuptools==65.5.1' wheel ; pip3 --version %23 buildkit Reacted by Shuchu HanMost of these are coming from python3.11 image used. Can you update that to latest non-vulnerable image?
Below image is from docker desktop. So after building the image you can check in vulnerabilities section if are any.
Reacted by Shuchu HanThank you for all the details, @brijesh-vora-sp , let me work on this.
Description:
There are quite some vulnerabilities in feast when I build docker image of k8s materialization engine.
Seems to be all go related. Would appreciate alteast removing critical and high one's ASAP. Thanks
Possible Solution
Upgrade packages?