ubuntu-docker-images team mailing list archive

[Sergio Durigan Junior <sergio.durigan@xxxxxxxxxxxxx>]

On Tuesday, March 22 2022, security-team-toolbox-bot@xxxxxxxxxxxxx wrote:

> New CVEs affecting packages used to build upstream based rocks have been
> created in the Ubuntu CVE tracker:
>
> * https://github.com/gogo/protobuf:
> * https://github.com/hashicorp/consul: CVE-2022-24687
> * https://github.com/prometheus/prometheus:
>
> Please review your rock to understand if it is affected by these CVEs.

I've investigated these packages and found that:

- Telegraf isn't affected on Jammy, because it uses consul 1.12.0 which
  already has a fix for the CVE.  Since the 22.04 ROCK image will be
  based on this package, we're covered.

- Cortex seems to be affected, even upstream's git HEAD.  I filed
  https://github.com/cortexproject/cortex/issues/4682.  I'm not 100%
  sure whether the specific consul feature that is affected by the CVE
  (Ingress Gateway) is used by cortex or not.  I will wait on upstream's
  answer to decide which action to take here.

Thanks,

-- 
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0  EB2F 106D A1C8 C3CB BF14