Fix CVE-2024-45337: Update golang.org/x/crypto in statsd_exporter to >= v0.31.0
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- docker, go
- 领域
- build-system, devops, security
调研方向
先查看 boil-config.toml 和 superset/README.md，以确定版本、约束文件、补丁目录以及重建 statsd_exporter 所需的输入。按照列出的构建和测试命令执行，包括 Trivy 检查和 operator 冒烟测试。完成的标准是：重建后的镜像没有 CVE-2024-45337 检测结果，适用的测试通过，并且所需的 release-note 更新已关联。
由索引模型根据 Issue 内容生成。
描述
Fix CVE-2024-45337: Update golang.org/x/crypto in statsd_exporter to >= v0.31.0
Part of https://github.com/stackabletech/docker-images/issues/xxx
Problem
The stackable/statsd_exporter image embedded in the Superset product image contains a CRITICAL vulnerability:
| CVE | Library | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2024-45337 | golang.org/x/crypto | v0.27.0 | v0.31.0 | CRITICAL |
Description: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto/ssh.
See: https://avd.aquasec.com/nvd/cve-2024-45337
This CVE is present in both:
oci.stackable.tech/sdp/superset:4.1.4-stackable26.3.0oci.stackable.tech/sdp/superset:6.0.0-stackable26.3.0
The statsd_exporter binary is compiled with golang.org/x/crypto v0.27.0. The fix requires rebuilding the binary with golang.org/x/crypto >= v0.31.0.
Note: While
statsd_exporterdoes not expose SSH functionality and the vulnerablePublicKeyCallbackcode path is not reachable at runtime, the vulnerability still triggers CRITICAL findings in standard security scanners (Trivy, Wiz, etc.), blocking internal compliance and image promotion pipelines.
- Add:
statsd_exporterbuilt withgolang.org/x/crypto >= v0.31.0 - Remove:
statsd_exporterbuilt withgolang.org/x/crypto v0.27.0
[!TIP] Please add the
scheduled-for/YY.M.Xlabel, and add to the Stackable Engineering project.
Update tasks
- [ ] Update
boil-config.tomlto reflect the agreed upon versions in the spreadsheet (including the removal of old versions). - [ ] Create a new constraints file (see
superset/README.md). - [ ] Create a file:
superset/stackable/patches/x.y.z/.gitkeep, add patches if applicable. - [ ] Delete old constraint files and patch directories.
- [ ] Update
golang.org/x/cryptodependency instatsd_exporterto>= v0.31.0and rebuild the binary. - [ ] Update other dependencies if applicable (e.g. python, auth_lib, cyclonedx-bom, etc).
- [ ] Check other operators (getting_started / kuttl / supported-versions) for usage of the versions. Add the PR(s) to the list below.
- [ ] Ensure prerequisites are up to date (required-external-components.adoc).
- [ ] Update the version in demos. Add the PR(s) to the list below.
Related Pull Requests
[!TIP] Delete any items that do not apply so that all applicable items can be checked.
- Link to the docker-images PR (statsd_exporter rebuild with patched crypto)
- Link to the operator PR (getting_started / kuttl / supported-versions)
- Link to any other operator PRs (getting_started / kuttl)
- Link to demo PR (raise against the
mainbranch) - Link to the Release Notes PR in the documentation repo (if not a comment below)
Acceptance
[!TIP] This list should be completed by the assignee(s), once respective PRs have been merged. Once all items have been checked, the issue can be moved into Development: Done.
- [ ] Can build image (either locally, or in CI)
- [ ] Trivy scan of rebuilt image shows CVE-2024-45337 resolved (no CRITICAL findings for
golang.org/x/crypto) - [ ] All kuttl tests pass (either locally, or in CI)
- [ ] Release notes added to documentation and linked as a PR above
- [ ] Release notes written in a comment below
- [ ] Applicable
release-notelabel added to this issue
# Verify the CVE is resolved after rebuild trivy image oci.stackable.tech/sdp/superset:x.y.z-stackable0.0.0-dev | grep CVE-2024-45337 # Should return no resultsStandard image build and test
Where x.y.z is the new version added in this PR
boil build superset=x.y.z --strip-architecture --load
kind load docker-image oci.stackable.tech/sdp/superset:x.y.z-stackable0.0.0-devChange directory into the superset-operator repository and update the
product version in tests/test-definition.yaml
./scripts/run-tests --test-suite smoke-latest # or similar
</details>
Please consider updating this template if these instructions are wrong, or could be made clearer.
# Fix CVE-2024-45337: Update `golang.org/x/crypto` in `statsd_exporter` to >= v0.31.0Part of https://github.com/stackabletech/docker-images/issues/xxx
- 主要语言
- Dockerfile
- 星标
- 22
- 派生
- 7
- 平均合并
- 3 天 15 小时
- 30 天内合并 PR
- 33
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stackabletech/docker-images 的其他 Issue
-
chore(trino): Update major/minor versions for 26.11.0可能已有人在做 @NickLarsenNZ 于 3 天前认领。 未关闭release-note/action-required scheduled-for/26.11.0
难度 4/5 3-5 天 新手友好度 35/100
stackabletech/docker-images#1657 · 1 条评论 · 已指派 1 人 ·
维护者通常 2 天内回复
-
scheduled-for/26.11.0
难度 4/5 3-5 天 新手友好度 48/100
stackabletech/docker-images#1655 ·
维护者通常 2 天内回复
-
scheduled-for/26.11.0
难度 4/5 3-5 天 新手友好度 52/100
stackabletech/docker-images#1652 ·
维护者通常 2 天内回复
-
scheduled-for/26.11.0
难度 4/5 3-5 天 新手友好度 45/100
stackabletech/docker-images#1649 ·
维护者通常 2 天内回复
-
chore(hbase-phoenix-omid): Update major/minor versions for 26.11.0可能已有人在做 @adwk67 于 18 天前认领。 未关闭scheduled-for/26.11.0
难度 4/5 3-5 天 新手友好度 55/100
stackabletech/docker-images#1647 · 已指派 1 人 ·
维护者通常 2 天内回复
查看 stackabletech/docker-images 的全部 Issue
相似的 Issue
-
needs-triage Platform(Default)
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
atlassian-labs/compiled#1960 ·
维护者通常 1 天内回复
-
Cached wheel reuse fails when the build and metadata fallback share an output directory可能已有人在做 @harbinresearcher 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
pypa/pyproject-hooks#240 · 1 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 6 天内回复