GHSA-m425-mq94-257g vulnerability in Google Cloud SDK 455.0.0 [312491160]

Assigned

Bug

Status Update

No update yet.

Description

pi...@secupi.com

created issue #1

Nov 22, 2023 11:04AM

Problem you have encountered: While doing a trivy scan of my image that includes Google Cloud SDK in version 455.0.0 I found 1 HIGH vulnerability:

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬────────────────────────┬───────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │     Fixed Version      │                       Title                       │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼────────────────────────┼───────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-m425-mq94-257g │ HIGH     │ fixed  │ v1.48.0           │ 1.56.3, 1.57.1, 1.58.3 │ gRPC-Go HTTP/2 Rapid Reset vulnerability          │
│                        │                     │          │        │                   │                        │ https://github.com/advisories/GHSA-m425-mq94-257g │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴────────────────────────┴───────────────────────────────────────────────────┘

What you expected to happen: Report to be clean.

Steps to reproduce:

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock:ro aquasec/trivy:latest image --vuln-type os,library --exit-code 1 --severity HIGH,CRITICAL --timeout 10m gcr.io/google.com/cloudsdktool/google-cloud-cli:455.0.0

Other information (workarounds you have tried, documentation consulted, etc): N/A

Comments

pi...@secupi.com <pi...@secupi.com> #2Nov 22, 2023 11:07AM

Most probably it's related to:

./bin/anthoscli:dep     google.golang.org/grpc  v1.48.0

va...@google.com <va...@google.com> Nov 23, 2023 07:01AM

Assigned to ku...@google.com.

ku...@google.com <ku...@google.com> #3Nov 28, 2023 01:55PM

Reassigned to gc...@google.com.

Hello,

Thank you for reaching out to us with your request.

Thank you for bringing this to our attention. However, the product engineering team is aware of this and currently in the process of evaluating it. While we cannot provide an estimated time of implementation or guarantee the fulfillment of the issue, please be assured that your input is highly valued. Your feedback enables us to enhance our products and services.

We appreciate your continued trust and support in improving our Google Cloud Platform products. In case you want to report a new issue, Please do not hesitate to create a new issue on the Issue Tracker providing a detailed description of your issue.

Once again, we sincerely appreciate your valuable feedback; Thank you for your understanding and collaboration.

pi...@secupi.com <pi...@secupi.com> #4Dec 11, 2023 04:06PM

Another issue that is in the sdk package is certifi version:

certifi	package	2022.12.7	CVE-2023-37920	25/07/2023			0			0				0		critical	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://nvd.nist.gov/vuln/detail/CVE-2023-37920	2023.7.22	Upgrade package certifi to version 2023.7.22 or above.		Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.							no_patch		FALSE		9.8	critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H			03/12/2023	03/12/2023		E:X/RL:O/RC:C			/google-cloud-sdk/platform/gsutil/third_party/google-auth-library-python/.kokoro/requirements.txt

I see this version was already updated in https://github.com/googleapis/google-auth-library-python/commit/65481be78b6e398fe54b976d7eca801db362cab2 - why it's not included in latest sdk?

Thanks!

ba...@google.com <ba...@google.com> Dec 14, 2023 02:21PM

Reassigned to ku...@google.com.

ku...@google.com <ku...@google.com> Dec 28, 2023 03:27PM