litmuschaos/litmus-go

Fix vulnerability found in kubernetes library to fix the trivy scan check

Open

#510 opened on Apr 26, 2022

View on GitHubContributor guide
 (2 comments) (0 reactions) (0 assignees)Go (147 forks)auto 404
good first issue

Repository metrics

Stars
 (85 stars)
PR merge metrics
 (Avg merge 127d 22h) (1 merged PR in 30d)

Description


litmus/experiments (gobinary)
=============================
Total: 1 (HIGH: 1, CRITICAL: 0)

+-------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+
|      LIBRARY      | VULNERABILITY ID | SEVERITY | INSTALLED VERSION |         FIXED VERSION          |                 TITLE                 |
+-------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+
| k8s.io/kubernetes | CVE-2021-25741   | HIGH     | v1.18.19          | 1.19.15, 1.20.11, 1.21.5,      | kubernetes: Symlink exchange          |
|                   |                  |          |                   | 1.22.2                         | can allow host filesystem access      |
|                   |                  |          |                   |                                | -->avd.aquasec.com/nvd/cve-2021-25741 |
+-------------------+------------------+----------+-------------------+--------------------------------+---------------------------------------+

Contributor guide

Research direction
Update the k8s.io/kubernetes dependency to a fixed version (>=1.19.15, 1.20.11, 1.21.5, or 1.22.2) in go.mod and run 'go mod tidy'. Ensure no breaking changes and verify the vulnerability is resolved by running a trivy scan.
Tech stack
go
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoKubernetes
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40