Harbor scan is showing multiple vulnerabilities in packages used in CDN 2.0.1 release #1150

embroede · 2022-03-09T21:47:12Z

embroede
Mar 9, 2022

Vulnerability               Severity                CVSS3           Package         Current version         Fixed in version

CVE-2021-3711               Critical                9.8             libcrypto1.1    1.1.1k-r0               1.1.1l-r0                               
CVE-2021-3711               Critical                9.8             libssl1.1       1.1.1k-r0               1.1.1l-r0              
CVE-2021-22945              Critical                9.1             curl            7.76.1-r0               7.79.0-r0             
CVE-2021-22945              Critical                9.1             libcurl         7.76.1-r0               7.79.0-r0                       
CVE-2021-36159              Critical                9.1             apk-tools       2.12.5-r0               2.12.6-r0                
CVE-2021-3712               High                    7.4             libcrypto1.1    1.1.1k-r0               1.1.1l-r0                         
CVE-2021-3712               High                    7.4             libssl1.1       1.1.1k-r0               1.1.1l-r0              
CVE-2021-22901              High                    8.1             curl            7.76.1-r0               7.77.0-r0                  
CVE-2021-22946              High                    7.5             curl            7.76.1-r0               7.79.0-r0                   
CVE-2021-22901              High                    8.1             libcurl         7.76.1-r0               7.77.0-r0            
CVE-2021-22946              High                    7.5             libcurl         7.76.1-r0               7.79.0-r0         
CVE-2021-33560              High                    7.5             libgcrypt       1.8.7-r0                1.8.8-r0                     
CVE-2021-3517               High                    8.6             libxml2         2.9.10-r6               2.9.10-r7                   
CVE-2021-3518               High                    8.8             libxml2         2.9.10-r6               2.9.10-r7                   
CVE-2021-22922              Medium                  6.5             curl            7.76.1-r0               7.78.0-r0                   
CVE-2021-22923              Medium                  5.3             curl            7.76.1-r0               7.78.0-r0                   
CVE-2021-22925              Medium                  5.3             curl            7.76.1-r0               7.78.0-r0                   
CVE-2021-22947              Medium                  5.9             curl            7.76.1-r0               7.79.0-r0                   
CVE-2021-22922              Medium                  6.5             libcurl         7.76.1-r0               7.78.0-r0                   
CVE-2021-22923              Medium                  5.3             libcurl         7.76.1-r0               7.78.0-r0                   
CVE-2021-22925              Medium                  5.3             libcurl         7.76.1-r0               7.78.0-r0                   
CVE-2021-22947              Medium                  5.9             libcurl         7.76.1-r0               7.79.0-r0                   
CVE-2021-40528              Medium                  5.9             libgcrypt       1.8.7-r0                1.8.8-r1                        
CVE-2021-20205              Medium                  6.5             libjpeg-turb    2.0.6-r0                2.1.0-r0                            
CVE-2021-3537               Medium                  5.9             libxml2         2.9.10-r6               2.9.10-r7                   
CVE-2021-3541               Medium                  6.5             libxml2         2.9.10-r6               2.9.11-r0

@mohafarooq

mfarooq-tech · 2022-03-10T03:32:29Z

mfarooq-tech
Mar 10, 2022
Maintainer

@gaius-qi @jim3ma : These vulnerabilities are coming from the CDN container image.

0 replies

embroede · 2022-04-07T04:08:48Z

embroede
Apr 7, 2022
Author

Just scanned v2.0.2 rc27, showing 6 more vulnerabilities:

Vulnerability       Severity        CVSS3   Package                 Current-Version         Fixed-In-Version
CVE-2021-3711       Critical        9.8     libcrypto1.1            1.1.1k-r0               1.1.1l-r0
CVE-2021-3711       Critical        9.8     libssl1.1               1.1.1k-r0               1.1.1l-r0
CVE-2021-22945      Critical        9.1     curl                    7.76.1-r0               7.79.0-r0
CVE-2021-22945      Critical        9.1     libcurl                 7.76.1-r0               7.79.0-r0
CVE-2021-36159      Critical        9.1     apk-tools               2.12.5-r0               2.12.6-r0    
CVE-2021-3712       High            7.4     libcrypto1.1            1.1.1k-r0               1.1.1l-r0       
CVE-2021-3712       High            7.4     libssl1.1               1.1.1k-r0               1.1.1l-r0    
CVE-2021-22901      High            8.1     curl                    7.76.1-r0               7.77.0-r0
CVE-2021-22946      High            7.5     curl                    7.76.1-r0               7.79.0-r0
CVE-2021-22901      High            8.1     libcurl                 7.76.1-r0               7.77.0-r0
CVE-2021-22946      High            7.5     libcurl                 7.76.1-r0               7.79.0-r0
CVE-2021-33560      High            7.5     libgcrypt               1.8.7-r0                1.8.8-r0    
CVE-2021-3517       High            8.6     libxml2                 2.9.10-r6               2.9.10-r7
CVE-2021-3518       High            8.8     libxml2                 2.9.10-r6               2.9.10-r7
CVE-2022-23308      High            7.5     libxml2                 2.9.10-r6               2.9.13-r0
CVE-2022-0778       High            7.5     libcrypto1.1            1.1.1k-r0               1.1.1n-r0       
CVE-2022-0778       High            7.5     libssl1.1               1.1.1k-r0               1.1.1n-r0    
CVE-2021-30560      High            8.8     libxslt                 1.1.34-r0               1.1.35-r0
CVE-2021-22922      Medium          6.5     curl                    7.76.1-r0               7.78.0-r0
CVE-2021-22923      Medium          5.3     curl                    7.76.1-r0               7.78.0-r0
CVE-2021-22925      Medium          5.3     curl                    7.76.1-r0               7.78.0-r0
CVE-2021-22947      Medium          5.9     curl                    7.76.1-r0               7.79.0-r0
CVE-2021-22922      Medium          6.5     libcurl                 7.76.1-r0               7.78.0-r0
CVE-2021-22923      Medium          5.3     libcurl                 7.76.1-r0               7.78.0-r0
CVE-2021-22925      Medium          5.3     libcurl                 7.76.1-r0               7.78.0-r0
CVE-2021-22947      Medium          5.9     libcurl                 7.76.1-r0               7.79.0-r0
CVE-2021-40528      Medium          5.9     libgcrypt               1.8.7-r0                1.8.8-r1
CVE-2021-20205      Medium          6.5     libjpeg-turbo           2.0.6-r0                2.1.0-r0
CVE-2021-3537       Medium          5.9     libxml2                 2.9.10-r6               2.9.10-r7
CVE-2021-3541       Medium          6.5     libxml2                 2.9.10-r6               2.9.11-r0
CVE-2018-25032      Medium          4.4     zlib                    1.2.11-r3               1.2.12-r0
CVE-2021-22898      Low             3.1     curl                    7.76.1-r0               7.77.0-r0
CVE-2021-22924      Low             3.7     curl                    7.76.1-r0               7.78.0-r0
CVE-2021-22898      Low             3.1     libcurl                 7.76.1-r0               7.77.0-r0
CVE-2021-22924      Low             3.7     libcurl                 7.76.1-r0               7.78.0-r0
CVE-2021-42374      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42375      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42378      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42379      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42380      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42381      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42382      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42383      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42384      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42385      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42386      Unknown                 busybox                 1.32.1-r6               1.32.1-r7
CVE-2021-42374      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42375      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42378      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42379      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42380      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42381      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42382      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42383      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42384      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42385      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-42386      Unknown                 ssl_client              1.32.1-r6               1.32.1-r7
CVE-2021-38561      Unknown                 golang.org/x/text       v0.3.6                  0.3.7
CVE-2022-28391      Unknown                 busybox                 1.32.1-r6               1.32.1-r8
CVE-2022-28391      Unknown                 ssl_client              1.32.1-r6               1.32.1-r8

0 replies

embroede · 2022-04-13T17:15:01Z

embroede
Apr 13, 2022
Author

Thanks for fixing these, we've scanned 2.0.2, and see only two CVE's now, which seem to be very new.

CVE-2022-1271
CVE-2021-38561

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Harbor scan is showing multiple vulnerabilities in packages used in CDN 2.0.1 release #1150

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments

{{title}}

{{title}}

{{title}}

Select a reply

Harbor scan is showing multiple vulnerabilities in packages used in CDN 2.0.1 release #1150

embroede Mar 9, 2022

Replies: 3 comments

mfarooq-tech Mar 10, 2022 Maintainer

embroede Apr 7, 2022 Author

embroede Apr 13, 2022 Author

embroede
Mar 9, 2022

mfarooq-tech
Mar 10, 2022
Maintainer

embroede
Apr 7, 2022
Author

embroede
Apr 13, 2022
Author