Critical vulnerabilities on keydb 6.3.4 image

[diecgia]

Hi,
The keydb 6.3.4 image is affected by the following critical vulnerabilities:
CVE-2024-24790, CVE-2023-24540, CVE-2023-24538, CVE-2022-23806

Would it be possible to update the image to fix these vulnerabilities?

Thanks for your help

[keithchew]

Hmm, the CVEs above is for golang, but keydb uses cpp/c?

[diecgia]

Yes, but these vulnerabilities are on eqalpha/keydb:latest image, which use ubuntu 20.04.

[keithchew]

I do not use keydb's image, but have built my own (also based on ubuntu 20.04). I cannot see go installed by default:

NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"

# go
bash: go: command not found

Can you confirm if the CVEs only affect keydb's image and not ubuntu 20.04 based images?

[diecgia]

The CVEs only affect keydb's image, I have scanned the ubuntu image and it doesn't have these vulnerabilities.
It's probably some of the dependencies installed in the dockerfile.

[keithchew]

Ah indeed. I can see in machamp_scripts/Dockerfile:

# use gosu for easy step-down from root: https://github.com/tianon/gosu/releases
ENV GOSU_VERSION 1.14
RUN set -eux; \
        savedAptMark="$(apt-mark showmanual)"; \
        apt-get update; \
        apt-get -o Dpkg::Options::="--force-confnew" install -y --no-install-recommends ca-certificates dirmngr gnupg wget; \
        rm -rf /var/lib/apt/lists/*; \
        dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')"; \
        wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch"; \

Likely that is the dependency that is running an older version of go. For those who can build their own image, perhaps you can try a later version using GOSU_VERSION...

[diecgia]

Yes, the vulnerabilities are for this package. I built an image from ubuntu and installing gosu 1.17 and the CVE-2022-23806 is fixed, but it's still affected by the other critical vulnerabilities. The following issue is created in gosu: tianon/gosu#136