Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade nginx from 1.27.0 to 1.27.1 #3409

Merged
merged 2 commits into from
Sep 15, 2024
Merged

[Snyk] Security upgrade nginx from 1.27.0 to 1.27.1 #3409

merged 2 commits into from
Sep 15, 2024

Conversation

yurake
Copy link
Owner

@yurake yurake commented Sep 7, 2024

snyk-top-banner

Snyk has created this PR to fix 5 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • kubernetes/nginx/Dockerfile

We recommend upgrading to nginx:1.27.1, as this image has only 93 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Integer Overflow or Wraparound
SNYK-DEBIAN12-AOM-7197979		   714  
critical severity Integer Overflow or Wraparound
SNYK-DEBIAN12-EXPAT-7855502		   571  
critical severity Integer Overflow or Wraparound
SNYK-DEBIAN12-EXPAT-7855503		   571  
critical severity XML External Entity (XXE) Injection
SNYK-DEBIAN12-EXPAT-7855507		   571  
medium severity Out-of-bounds Read
SNYK-DEBIAN12-CURL-7575306		   514  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 XML External Entity (XXE) Injection

@what-the-diff What The Diff
Copy link

what-the-diff bot commented Sep 7, 2024

PR Summary

  • Update to newer NGINX version in Dockerfile
    This modification updates our underlying software infrastructure to a more recent version, potentially providing better performance, security, and stability.

@github-actions github-actions bot added kubernetes someone for kubernetes docker Pull requests that update Docker code labels Sep 7, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 7, 2024
View reviewed changes
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Cleartext Transmission of Sensitive Information vulnerability in curl Critical

This file introduces a vulnerable curl package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Out-of-bounds Write vulnerability in curl Critical

This file introduces a vulnerable curl package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Integer Overflow or Wraparound vulnerability in expat Critical

This file introduces a vulnerable expat package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Integer Overflow or Wraparound vulnerability in expat Critical

This file introduces a vulnerable expat package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - XML External Entity (XXE) Injection vulnerability in expat Critical

This file introduces a vulnerable expat package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - CVE-2024-37371 vulnerability in krb5 Critical

This file introduces a vulnerable krb5 package with a critical severity vulnerability.
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Integer Overflow or Wraparound vulnerability in zlib Critical

This file introduces a vulnerable zlib package with a critical severity vulnerability.
@codeclimate CodeClimate
Copy link

codeclimate bot commented Sep 15, 2024

Code Climate has analyzed commit e86f77d and detected 0 issues on this pull request.

View more on Code Climate.

@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

github-advanced-security[bot]
github-advanced-security bot found potential problems Sep 15, 2024
View reviewed changes
kubernetes/nginx/Dockerfile
@@ -1,4 +1,4 @@
FROM nginx:1.27.0
FROM nginx:1.27.1

Check failure

Code scanning / Snyk Container

Critical severity - Out-of-bounds Read vulnerability in db5.3 Critical

This file introduces a vulnerable db5.3 package with a critical severity vulnerability.
@yurake yurake merged commit 2103851 into master Sep 15, 2024
63 of 64 checks passed
@yurake yurake deleted the snyk-fix-14cfd9e4091a48a73730e78d84ab3dac branch September 15, 2024 03:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
docker Pull requests that update Docker code kubernetes someone for kubernetes size/XS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@yurake @snyk-bot