ubuntu-docker-images team mailing list archive

[Athos Ribeiro <athos.ribeiro@xxxxxxxxxxxxx>]

On Thu, Apr 21, 2022 at 05:01:49AM +0000, security-team-toolbox-bot@xxxxxxxxxxxxx wrote:
> New CVEs affecting packages used to build upstream based rocks have been
> created in the Ubuntu CVE tracker:
>
> * https://github.com/gogo/protobuf:
> * https://github.com/hashicorp/consul: CVE-2022-29153
> * https://github.com/prometheus/prometheus:
>
> Please review your rock to understand if it is affected by these CVEs.
>
> Thank you for your rock and for attending to this matter.
>
> References:
> https://git.launchpad.net/ubuntu-cve-tracker/tree/active/CVE-2022-29153
>
>
>
> --
> Mailing list: https://launchpad.net/~ubuntu-docker-images
> Post to     : ubuntu-docker-images@xxxxxxxxxxxxxxxxxxx
> Unsubscribe : https://launchpad.net/~ubuntu-docker-images
> More help   : https://help.launchpad.net/ListHelp

The new telegraf 22.04 ROCK does not ship the affected version of
consul.

While the cortex ROCK does use a consul version that is affected by this
CVE, it only ships the consul/api client package, which is not affected
by the CVE.

No actions should be needed from our end here.

--
Athos Ribeiro