UNCLASSIFIED - NO CUI

chore(findings): bigbang/fluentd-aggregator

Summary

bigbang/fluentd-aggregator has 79 new findings discovered during continuous monitoring.

id source severity package
CVE-2022-0413 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2022-0392 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2021-4193 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2017-7643 anchore_cve High proxifier-1.0.3
CVE-2017-7690 anchore_cve High proxifier-1.0.3
CVE-2022-0261 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2021-3984 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-0318 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2021-3872 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2020-7712 anchore_cve High json-2.6.1
CVE-2008-1145 anchore_cve Medium webrick-1.7.0
CVE-2021-4019 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2021-4192 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2021-4122 oscap_comp Medium
CVE-2021-3521 oscap_comp Medium
CVE-2021-3872 oscap_comp Medium
CVE-2021-3984 oscap_comp Medium
CVE-2021-4019 oscap_comp Medium
CVE-2021-4192 oscap_comp Medium
CVE-2021-4193 oscap_comp Medium
CCE-80667-9 oscap_comp Medium
CCE-80669-5 oscap_comp Medium
CCE-80670-3 oscap_comp Medium
CCE-81037-4 oscap_comp Medium
CCE-81035-8 oscap_comp Medium
CVE-2022-0361 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2022-24407 twistlock_cve Critical cyrus-sasl-lib-2.1.27-5.el8
CVE-2022-24407 oscap_comp Medium
CVE-2020-10663 twistlock_cve High json-FILE)).chomp
CVE-2013-0269 twistlock_cve High json-FILE)).chomp
CVE-2022-0413 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-0359 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-24407 anchore_cve High cyrus-sasl-lib-2.1.27-5.el8
CVE-2022-0361 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-0392 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-23708 anchore_cve Medium elasticsearch-7.16.1
CVE-2022-23308 oscap_comp Medium
CVE-2021-3999 oscap_comp Medium
CVE-2022-23218 oscap_comp Medium
CVE-2022-23219 oscap_comp Medium
CVE-2022-0261 oscap_comp Medium
CVE-2022-0318 oscap_comp Medium
CVE-2022-0359 oscap_comp Medium
CVE-2022-0361 oscap_comp Medium
CVE-2022-0392 oscap_comp Medium
CVE-2022-0413 oscap_comp Medium
CVE-2021-23177 oscap_comp Medium
CVE-2021-31566 oscap_comp Medium
CVE-2022-0778 oscap_comp Medium
CVE-2022-24795 twistlock_cve High yajl-ruby-1.4.1
GHSA-jj47-x69x-mxrm anchore_cve Medium yajl-ruby-1.4.1
CVE-2022-1154 anchore_cve Low vim-minimal-2:8.0.1763-16.el8
CVE-2022-1154 oscap_comp Medium
CVE-2022-1271 oscap_comp Medium
CVE-2022-1271 twistlock_cve Critical gzip-1.9-12.el8
CVE-2022-1154 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2018-25032 oscap_comp Medium
CVE-2022-1292 twistlock_cve Medium openssl-1.1.1k-5.el8_5
CVE-2022-1292 twistlock_cve Medium openssl-libs-1.1.1k-5.el8_5
CVE-2022-29824 twistlock_cve Medium python3-libxml2-2.9.7-9.el8_4.2
CVE-2022-29824 twistlock_cve Medium libxml2-2.9.7-9.el8_4.2
CVE-2022-29824 anchore_cve Medium python3-libxml2-2.9.7-9.el8_4.2
CVE-2022-29824 anchore_cve Medium libxml2-2.9.7-9.el8_4.2
CVE-2022-1619 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2021-3634 oscap_comp Medium
CVE-2021-3737 oscap_comp Medium
CVE-2021-4189 oscap_comp Medium
CVE-2022-1621 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2022-1629 twistlock_cve Medium vim-minimal-8.0.1763-16.el8
CVE-2021-44568 twistlock_cve Medium libsolv-0.7.19-1.el8
CVE-2022-1769 twistlock_cve Low vim-minimal-8.0.1763-16.el8
CVE-2022-1733 twistlock_cve Low vim-minimal-8.0.1763-16.el8
CVE-2021-44568 anchore_cve Low libsolv-0.7.19-1.el8
CVE-2022-1735 twistlock_cve Low vim-minimal-8.0.1763-16.el8
CVE-2022-1771 twistlock_cve Low vim-minimal-8.0.1763-16.el8
CVE-2022-1621 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-1629 anchore_cve Medium vim-minimal-2:8.0.1763-16.el8
CVE-2022-1434 twistlock_cve Medium openssl-1.1.1k-5.el8_5
CVE-2022-1434 twistlock_cve Medium openssl-libs-1.1.1k-5.el8_5

VAT: https://vat.dso.mil/vat/container/16646?branch=master
More information can be found in the failed pipeline located here: https://repo1.dso.mil/dsop/big-bang/fluentd-aggregator/-/jobs/9880127

Definition of Done

Justifications:

  • All findings have been justified
  • Justifications have been provided to the container hardening team

Approval Process:

  • Findings Approver has reviewed and approved all justifications
  • Approval request has been sent to Authorizing Official
  • Approval request has been processed by Authorizing Official
Edited by Ghost User
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information