chore(findings): bigbang/fluentd-aggregator

Ghost User
2023-03-08T12:19:55Z

## Summary bigbang/fluentd-aggregator has 213 new findings discovered during continuous monitoring. id | source | severity | package -- | ------ | -------- | ------- CVE-2022-32208 | Anchore CVE | Medium | libcurl-7.61.1-22.el8 CVE-2022-32206 | Anchore CVE | Medium | libcurl-7.61.1-22.el8 CVE-2022-32208 | Anchore CVE | Medium | curl-7.61.1-22.el8 CVE-2022-32206 | Anchore CVE | Medium | curl-7.61.1-22.el8 CVE-2022-1621 | OSCAP Compliance | Medium | CVE-2022-1629 | OSCAP Compliance | Medium | CVE-2022-29824 | OSCAP Compliance | Medium | CVE-2022-25313 | OSCAP Compliance | Medium | CVE-2022-25314 | OSCAP Compliance | Medium | CVE-2022-22576 | OSCAP Compliance | Medium | CVE-2022-27774 | OSCAP Compliance | Medium | CVE-2022-27776 | OSCAP Compliance | Medium | CVE-2022-27782 | OSCAP Compliance | Medium | CVE-2021-40528 | OSCAP Compliance | Medium | CVE-2022-2097 | Twistlock CVE | Medium | openssl-libs-1.1.1k-6.el8_5 CVE-2022-1292 | OSCAP Compliance | Medium | CVE-2022-2068 | OSCAP Compliance | Medium | CVE-2022-2097 | OSCAP Compliance | Medium | CVE-2022-1785 | OSCAP Compliance | Medium | CVE-2022-1897 | OSCAP Compliance | Medium | CVE-2022-1927 | OSCAP Compliance | Medium | CVE-2022-1586 | OSCAP Compliance | Medium | CVE-2022-2183 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2182 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2207 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-32206 | Twistlock CVE | Medium | curl-7.61.1-22.el8 CVE-2022-32206 | Twistlock CVE | Medium | libcurl-7.61.1-22.el8 CVE-2018-20839 | Twistlock CVE | Medium | systemd-pam-239-58.el8 CVE-2018-20839 | Twistlock CVE | Medium | systemd-239-58.el8 CVE-2018-20839 | Twistlock CVE | Medium | systemd-libs-239-58.el8 CVE-2022-2206 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2016-3709 | Twistlock CVE | Medium | libxml2-2.9.7-13.el8 CVE-2016-3709 | Twistlock CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2022-32208 | Twistlock CVE | Medium | libcurl-7.61.1-22.el8 CVE-2022-32208 | Twistlock CVE | Medium | curl-7.61.1-22.el8 CVE-2022-2210 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2345 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2344 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2343 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-3927 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-4166 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2020-35512 | Twistlock CVE | Low | dbus-daemon-1.12.8-18.el8 CVE-2020-35512 | Twistlock CVE | Low | dbus-1.12.8-18.el8 CVE-2020-35512 | Twistlock CVE | Low | dbus-common-1.12.8-18.el8 CVE-2020-35512 | Twistlock CVE | Low | dbus-tools-1.12.8-18.el8 CVE-2020-35512 | Twistlock CVE | Low | dbus-libs-1.12.8-18.el8 CVE-2022-2522 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-0351 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2819 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-3997 | Twistlock CVE | Low | systemd-libs-239-58.el8 CVE-2021-3997 | Twistlock CVE | Low | systemd-pam-239-58.el8 CVE-2021-3997 | Twistlock CVE | Low | systemd-239-58.el8 CVE-2018-20786 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2286 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2285 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2284 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2287 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2208 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-46195 | Twistlock CVE | Low | libgcc-8.5.0-10.el8 CVE-2021-46195 | Twistlock CVE | Low | libstdc++-8.5.0-10.el8 CVE-2019-14250 | Twistlock CVE | Low | libstdc++-8.5.0-10.el8 CVE-2019-14250 | Twistlock CVE | Low | libgcc-8.5.0-10.el8 CVE-2018-20657 | Twistlock CVE | Low | libstdc++-8.5.0-10.el8 CVE-2018-20657 | Twistlock CVE | Low | libgcc-8.5.0-10.el8 CVE-2021-3974 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2016-3709 | Anchore CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2016-3709 | Anchore CVE | Medium | libxml2-2.9.7-13.el8 CVE-2022-2526 | Twistlock CVE | Critical | systemd-libs-239-58.el8 CVE-2022-2526 | Twistlock CVE | Critical | systemd-239-58.el8 CVE-2022-2526 | Twistlock CVE | Critical | systemd-pam-239-58.el8 CVE-2022-2845 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2526 | Anchore CVE | High | systemd-pam-239-58.el8 CVE-2022-2526 | Anchore CVE | High | systemd-libs-239-58.el8 CVE-2022-2526 | Anchore CVE | High | systemd-239-58.el8 CVE-2022-2946 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2923 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-32206 | OSCAP Compliance | Medium | CVE-2022-32208 | OSCAP Compliance | Medium | CVE-2022-2849 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-2526 | OSCAP Compliance | Medium | CVE-2022-3037 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-3826 | Twistlock CVE | Low | libstdc++-8.5.0-10.el8 CVE-2021-3826 | Twistlock CVE | Low | libgcc-8.5.0-10.el8 CVE-2022-35252 | Twistlock CVE | Low | curl-7.61.1-22.el8 CVE-2022-35252 | Twistlock CVE | Low | libcurl-7.61.1-22.el8 CVE-2022-35252 | Anchore CVE | Low | libcurl-7.61.1-22.el8 CVE-2022-35252 | Anchore CVE | Low | curl-7.61.1-22.el8 CVE-2022-2980 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-3153 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-34903 | OSCAP Compliance | Medium | CVE-2015-20107 | OSCAP Compliance | Medium | CVE-2022-0391 | OSCAP Compliance | Medium | CVE-2022-3219 | Twistlock CVE | Low | gnupg2-2.2.20-2.el8 CVE-2022-3235 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-3234 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-3296 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-3352 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-40674 | Anchore CVE | High | expat-2.2.5-8.el8 CVE-2022-3256 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-42012 | Twistlock CVE | Medium | dbus-daemon-1.12.8-18.el8 CVE-2022-42012 | Twistlock CVE | Medium | dbus-libs-1.12.8-18.el8 CVE-2022-42012 | Twistlock CVE | Medium | dbus-1.12.8-18.el8 CVE-2022-42012 | Twistlock CVE | Medium | dbus-tools-1.12.8-18.el8 CVE-2022-42012 | Twistlock CVE | Medium | dbus-common-1.12.8-18.el8 CVE-2022-42011 | Twistlock CVE | Medium | dbus-1.12.8-18.el8 CVE-2022-42011 | Twistlock CVE | Medium | dbus-libs-1.12.8-18.el8 CVE-2022-42011 | Twistlock CVE | Medium | dbus-tools-1.12.8-18.el8 CVE-2022-42011 | Twistlock CVE | Medium | dbus-daemon-1.12.8-18.el8 CVE-2022-42011 | Twistlock CVE | Medium | dbus-common-1.12.8-18.el8 CVE-2022-42010 | Twistlock CVE | Medium | dbus-tools-1.12.8-18.el8 CVE-2022-42010 | Twistlock CVE | Medium | dbus-daemon-1.12.8-18.el8 CVE-2022-42010 | Twistlock CVE | Medium | dbus-1.12.8-18.el8 CVE-2022-42010 | Twistlock CVE | Medium | dbus-common-1.12.8-18.el8 CVE-2022-42010 | Twistlock CVE | Medium | dbus-libs-1.12.8-18.el8 CVE-2022-42012 | Anchore CVE | Medium | dbus-common-1:1.12.8-18.el8 CVE-2022-42011 | Anchore CVE | Medium | dbus-daemon-1:1.12.8-18.el8 CVE-2022-42012 | Anchore CVE | Medium | dbus-1:1.12.8-18.el8 CVE-2022-42012 | Anchore CVE | Medium | dbus-daemon-1:1.12.8-18.el8 CVE-2022-42011 | Anchore CVE | Medium | dbus-tools-1:1.12.8-18.el8 CVE-2022-42010 | Anchore CVE | Medium | dbus-1:1.12.8-18.el8 CVE-2022-42010 | Anchore CVE | Medium | dbus-daemon-1:1.12.8-18.el8 CVE-2022-42010 | Anchore CVE | Medium | dbus-common-1:1.12.8-18.el8 CVE-2022-42011 | Anchore CVE | Medium | dbus-common-1:1.12.8-18.el8 CVE-2022-42010 | Anchore CVE | Medium | dbus-tools-1:1.12.8-18.el8 CVE-2022-42010 | Anchore CVE | Medium | dbus-libs-1:1.12.8-18.el8 CVE-2022-42012 | Anchore CVE | Medium | dbus-libs-1:1.12.8-18.el8 CVE-2022-42012 | Anchore CVE | Medium | dbus-tools-1:1.12.8-18.el8 CVE-2022-42011 | Anchore CVE | Medium | dbus-1:1.12.8-18.el8 CVE-2022-42011 | Anchore CVE | Medium | dbus-libs-1:1.12.8-18.el8 CVE-2022-40304 | Twistlock CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2022-40304 | Twistlock CVE | Medium | libxml2-2.9.7-13.el8 CVE-2022-40303 | Twistlock CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2022-40303 | Twistlock CVE | Medium | libxml2-2.9.7-13.el8 CCE-86534-5 | OSCAP Compliance | Medium | CCE-83434-1 | OSCAP Compliance | Medium | CVE-2022-40303 | Anchore CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2022-40303 | Anchore CVE | Medium | libxml2-2.9.7-13.el8 CVE-2022-40304 | Anchore CVE | Medium | libxml2-2.9.7-13.el8 CVE-2022-40304 | Anchore CVE | Medium | python3-libxml2-2.9.7-13.el8 CVE-2022-40674 | Twistlock CVE | Critical | expat-2.2.5-8.el8 CVE-2020-35525 | OSCAP Compliance | Medium | CVE-2020-35527 | OSCAP Compliance | Medium | CVE-2022-37434 | OSCAP Compliance | Medium | CVE-2022-2509 | OSCAP Compliance | Medium | CVE-2022-3515 | OSCAP Compliance | Medium | CCE-85888-6 | OSCAP Compliance | Medium | CCE-84038-9 | OSCAP Compliance | Medium | CVE-2022-3705 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-3821 | Twistlock CVE | Medium | systemd-239-58.el8 CVE-2022-3821 | Twistlock CVE | Medium | systemd-libs-239-58.el8 CVE-2022-3821 | Twistlock CVE | Medium | systemd-pam-239-58.el8 GHSA-fppq-mj76-fpj2 | Anchore CVE | Low | fluentd-1.14.6 CVE-2022-3821 | Anchore CVE | Medium | systemd-239-58.el8 CVE-2022-3821 | Anchore CVE | Medium | systemd-libs-239-58.el8 CVE-2022-3821 | Anchore CVE | Medium | systemd-pam-239-58.el8 CVE-2022-43680 | Twistlock CVE | Medium | expat-2.2.5-8.el8 CVE-2022-39379 | Twistlock CVE | Critical | fluentd-1.14.6 CVE-2022-1304 | OSCAP Compliance | Medium | CVE-2016-3709 | OSCAP Compliance | Medium | CVE-2022-42898 | Twistlock CVE | Critical | krb5-libs-1.18.2-14.el8 CVE-2022-45061 | Twistlock CVE | Medium | platform-python-3.6.8-45.el8 CVE-2022-45061 | Twistlock CVE | Medium | python3-libs-3.6.8-45.el8 CVE-2022-36227 | Twistlock CVE | Low | libarchive-3.3.3-3.el8_5 CVE-2022-43680 | Anchore CVE | Medium | expat-2.2.5-8.el8 CVE-2022-42898 | Anchore CVE | High | krb5-libs-1.18.2-14.el8 CVE-2007-4559 | Anchore CVE | Medium | platform-python-3.6.8-45.el8 CVE-2007-4559 | Anchore CVE | Medium | python3-libs-3.6.8-45.el8 CVE-2022-45061 | Anchore CVE | Medium | python3-libs-3.6.8-45.el8 CVE-2022-45061 | Anchore CVE | Medium | platform-python-3.6.8-45.el8 CVE-2022-35737 | Anchore CVE | Medium | sqlite-libs-3.26.0-15.el8 CVE-2022-36227 | Anchore CVE | Low | libarchive-3.3.3-3.el8_5 CVE-2022-42898 | OSCAP Compliance | Medium | CVE-2022-4292 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-4293 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-4285 | Twistlock CVE | Medium | gdb-gdbserver-8.2-18.el8 CVE-2022-46908 | Twistlock CVE | Medium | sqlite-libs-3.26.0-15.el8 CVE-2022-4285 | Anchore CVE | Medium | gdb-gdbserver-8.2-18.el8 CVE-2022-4415 | Twistlock CVE | Medium | systemd-pam-239-58.el8 CVE-2022-4415 | Twistlock CVE | Medium | systemd-239-58.el8 CVE-2022-4415 | Twistlock CVE | Medium | systemd-libs-239-58.el8 CVE-2022-43552 | Twistlock CVE | Low | libcurl-7.61.1-22.el8 CVE-2022-43552 | Twistlock CVE | Low | curl-7.61.1-22.el8 CVE-2022-4415 | Anchore CVE | Medium | systemd-libs-239-58.el8 CVE-2022-43552 | Anchore CVE | Low | curl-7.61.1-22.el8 CVE-2022-4415 | Anchore CVE | Medium | systemd-239-58.el8 CVE-2022-43552 | Anchore CVE | Low | libcurl-7.61.1-22.el8 CVE-2022-4415 | Anchore CVE | Medium | systemd-pam-239-58.el8 CVE-2022-35737 | Twistlock CVE | Medium | sqlite-libs-3.26.0-15.el8 CVE-2022-4141 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2023-0049 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2021-46848 | OSCAP Compliance | Medium | CVE-2022-35737 | OSCAP Compliance | Medium | CVE-2022-43680 | OSCAP Compliance | Medium | CVE-2022-3821 | OSCAP Compliance | Medium | CVE-2022-42010 | OSCAP Compliance | Medium | CVE-2022-42011 | OSCAP Compliance | Medium | CVE-2022-42012 | OSCAP Compliance | Medium | CVE-2023-0054 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-47629 | Twistlock CVE | Critical | libksba-1.3.5-7.el8 CVE-2022-47629 | Anchore CVE | High | libksba-1.3.5-7.el8 CVE-2022-40303 | OSCAP Compliance | Medium | CVE-2022-40304 | OSCAP Compliance | Medium | CVE-2022-45873 | Twistlock CVE | Medium | systemd-pam-239-58.el8 CVE-2022-45873 | Twistlock CVE | Medium | systemd-libs-239-58.el8 CVE-2022-45873 | Twistlock CVE | Medium | systemd-239-58.el8 CVE-2022-37454 | Twistlock CVE | Critical | platform-python-3.6.8-45.el8 CVE-2022-37454 | Twistlock CVE | Critical | python3-libs-3.6.8-45.el8 CVE-2022-23990 | Twistlock CVE | Medium | expat-2.2.5-8.el8 CVE-2023-0051 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2023-0288 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2023-0433 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2022-47024 | Twistlock CVE | Low | vim-minimal-8.0.1763-16.el8_5.13 CVE-2023-0288 | Anchore CVE | Low | vim-minimal-2:8.0.1763-16.el8_5.13 VAT: https://vat.dso.mil/vat/image?imageName=bigbang/fluentd-aggregator&tag=1.14.2&branch=master
More information can be found in the failed pipeline located here: https://repo1.dso.mil/dsop/big-bang/fluentd-aggregator/-/jobs/12937103 ## Tasks Contributor: - [ ] Provide justifications for findings in the [VAT](https://vat.dso.mil) ([docs](https://repo1.dso.mil/dsop/dccscr/-/blob/master/pre-approval/vat.md)) - [ ] Apply the ~"Approval" label to this issue and wait for feedback Iron Bank: - [ ] Review findings and justifications - [ ] Send approval request to Authorizing Official - [ ] Close issue after approval from Authorizing Official > Note: If the above approval process is rejected for any reason, the `Approval` label will be removed and the issue will be sent back to `Open`. Any comments will be listed in this issue for you to address. Once they have been addressed, you **must** re-add the `Approval` label. ## Questions? Contact the Iron Bank team by commenting on this issue with your questions or concerns. If you do not receive a response, add `/cc @ironbank-notifications/onboarding`. Additionally, Iron Bank hosts an [AMA](https://www.zoomgov.com/meeting/register/vJIsf-ytpz8qHSN_JW8Hl9Qf0AZZXSCSmfo) working session every Wednesday from 1630-1730EST to answer questions.