Security Vulnerabilities CVE-2020-12723 CVE-2018-12886 CVE-2020-13777

[vchinasm]

Team,

The below listed vulnerabilities are being flagged by our security scanner.

Security Vulnerabilities
CVE-2020-12723
CVE-2018-12886
CVE-2020-13777

Are you going to fix them in the future releases?

[ihcsim]

@vchinasm Looks like those are coming from your host OS, not Linkerd. E.g. for Ubuntu, see CVE-2020-12723, CVE-2018-12886, CVE-2020-13777.

[ihcsim]

@vchinasm My bad. Looks like those come from our Debian-based Docker images. (I mistakenly thought that we are using only scratch images.) Yes, we will look into it.

[vchinasm]

Thank you @ihcsim .

[ihcsim]

See #4888

[alpeb]

@vchinasm could you please clarify which containers have these vulnerabilities? We use debian-buster as a base for some of our images, which already has a fix for CVE-2020-13777 and doesn't have reports for the other two CVEs.

And then we depend on Alpine through our linkerd-grafana component, which does have the CVE-2020-13777 and CVE-2020-12723 vulnerabilities, so I'll upgrade that dependency to grab those fixes. But I don't see where the CVE-2018-12886 one (for gcc) comes from...