8.0.3 image scan not clean

[xueshanf]

We would like to upgrade from 7.3 image to 8.0.3, however, the 8.0.3 container image scan shows 57 security vulnerabilities and all of them have fixes from package vendors. We use GCP container image scan service.

Would you mind updating the image with latest OS patches? I can help to scan if necessary.

Thanks!

[nwang92]

Could you elaborate more on the errors you're seeing and how to reproduce them?

As far as I'm aware, we do use the clair scanner as part of CircleCI, which should flag any vulnerabilities in the image OS layer. I haven't seen that stage fail in a while, but wondering if you're also using clair or something else?

[xueshanf]

I am using google gcr.io registry which comes with image scan service.
To produce the scan report, I pulled splunk/universalforwarder impage from dockerhub, and tagged it and push to GCP project's gcr.io container registry. Google container service scanned it. Here is part of the result screenshot:

For example, the first one CVE-2019-19768, detailed info is

Affected location	
cpe:/o:redhat:enterprise_linux:8
Package	
kernel-headers
Version	
4.18.0 147.8.1.el8_1
Fixed in version	
4.18.0 193.el8

[xueshanf]

Could you elaborate more on the errors you're seeing and how to reproduce them?

As far as I'm aware, we do use the clair scanner as part of CircleCI, which should flag any vulnerabilities in the image OS layer. I haven't seen that stage fail in a while, but wondering if you're also using clair or something else?

Clair may not have CVE database for redhat:enterprise_linux:8?

[nwang92]

Took me a sec to get access to a GCloud acc, but I can see the vulnerabilities. I checked splunk/splunk:8.0.4 and only got 17 medium level ones, but I'll go through the latest edge images and get them sorted out for the next release.