ubuntu-docker-images team mailing list archive

[Sergio Durigan Junior <sergio.durigan@xxxxxxxxxxxxx>]

On Tuesday, July 27 2021, security-team-toolbox-bot@xxxxxxxxxxxxx wrote:

> New CVEs affecting packages used to build upstream based rocks have been
> created in the Ubuntu CVE tracker:
>
> * https://github.com/prometheus/prometheus:
> * https://github.com/hashicorp/consul: CVE-2021-32574, CVE-2021-36213
> * https://github.com/gogo/protobuf:
>
> Please review your rock to understand if it is affected by these CVEs.
>
> Thank you for your rock and for attending to this matter.
>
> References:
> https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2021-32574
> https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2021-36213

Hi Emi,

I found the message above a bit confusing.  There are three components
listed (prometheus/prometheus, hashicorp/consul and gogo/protobuf), but
only one (hashicorp/consul) has CVEs listed for it.  Do the other two
components also have CVEs opened against them?  Is there any reason why
they're being listed in the message?

Thanks!

-- 
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0  EB2F 106D A1C8 C3CB BF14