Vulnerability CVE-2022-23308 for libxml2

[fred214]

Hi, our scanner reported libxm2 v2.9.12-r1 has vulnerability, I think it belong to upstream, and already create issue alpinelinux/docker-alpine#240.
I want to know what is the libxm2 used for? https://github.com/kubernetes/ingress-nginx/blob/main/images/nginx/rootfs/Dockerfile#L50, maybe I can remove it from base image.
As my understanding Alpine is base binary release, is there any possibility that I can build it like other library which is used for nginx? Thanks a lot

[longwuyuan]

Please show your scanner's report.

[longwuyuan]

removing label bug until the report is available here to look at

/remove-kind bug

[longwuyuan]

grype does not see this CVE

[fred214]

alpinelinux/docker-alpine#240
After I reported the libxml2 has update to 2.9.13-r0 in alpine:3.14 in 2022-03-11 01:00:28, https://pkgs.alpinelinux.org/packages?name=libxml2&branch=v3.14
I will re-scan the image after rebuild

[strongjz]

My understanding is that Libxml2 is used for XML parsing, https://en.wikipedia.org/wiki/Libxml2

The ngx_http_xslt_module requires Libxml2.

/triage accepted
/kind bug
/priority backlog

Once you get an answer back from the Alpine linux issue we can look to implement that fix.

Thank you,
James

[strongjz]

we discussed in the community 3/15 about upgrading to alpine 3.15. Let's test that and move forward with the update.

@fred214 can you the post the tool you used for scanning and the CVE for this vunl. Thanks

-James

[cegganesh84]

Here is my scan report with acquasecurity/trivy

% trivy image --light --exit-code 1 --ignore-unfixed --vuln-type os --severity UNKNOWN,HIGH,CRITICAL k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
2022-03-15T11:08:36.837-0700	WARN	'--light' option is deprecated and will be removed. See also: https://github.com/aquasecurity/trivy/discussions/1649
2022-03-15T11:08:36.920-0700	INFO	Need to update DB
2022-03-15T11:08:36.920-0700	INFO	Downloading DB...
29.92 MiB / 29.92 MiB [------------------------------------------------------------------------------] 100.00% 3.25 MiB p/s 9.4s
2022-03-15T11:08:58.088-0700	INFO	Detected OS: alpine
2022-03-15T11:08:58.088-0700	INFO	Detecting Alpine vulnerabilities...

k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c (alpine 3.14.2)
==================================================================================================================================
Total: 1 (UNKNOWN: 0, HIGH: 1, CRITICAL: 0)

+---------+------------------+----------+-------------------+---------------+---------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+---------+------------------+----------+-------------------+---------------+---------------------------------------+
| libxml2 | CVE-2022-23308   | HIGH     | 2.9.12-r1         | 2.9.13-r0     | libxml2: Use-after-free               |
|         |                  |          |                   |               | of ID and IDREF attributes            |
|         |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2022-23308 |
+---------+------------------+----------+-------------------+---------------+---------------------------------------+

[fred214]

The alpine:3.14 has update libxml2 version to 2.9.13-r0 in 2022.3.11, https://pkgs.alpinelinux.org/packages?name=libxml2&branch=v3.14
It has passed our scanner, thanks for the reply

[longwuyuan]

/reopen

[~]
% docker images | grep -i "ingress-nginx/controller"
k8s.gcr.io/ingress-nginx/controller 7e5c1cecb086 2 weeks ago 286MB

% grype docker images | grep -i "ingress-nginx/controller" | awk '{print $3}'
✔ Vulnerability DB [updated]
New version of grype is available: 0.34.1
✔ Loaded image
✔ Parsed image
✔ Cataloged packages [113 packages]
✔ Scanned image [4 vulnerabilities]

NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
google.golang.org/protobuf v1.27.1 CVE-2015-5237 High
google.golang.org/protobuf v1.27.1 CVE-2021-22570 High
libxml2 2.9.12-r1 2.9.13-r0 CVE-2022-23308 High
[~]
% grype k8s.gcr.io/ingress-nginx/controller:v0.50.0@sha256:f46fc2d161c97a9d950635acb86fb3f8d4adcfb03ee241ea89c6cde16aa3fdf8
✔ Vulnerability DB [no update available]
New version of grype is available: 0.34.1
✔ Pulled image
✔ Loaded image
✔ Parsed image
✔ Cataloged packages [115 packages]
✔ Scanned image [6 vulnerabilities]

NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
github.com/opencontainers/runc v1.0.1 1.0.3 GHSA-v95c-p5hm-xq8f Medium
github.com/prometheus/client_golang v1.11.0 CVE-2022-21698 High
google.golang.org/protobuf v1.26.0 CVE-2015-5237 High
google.golang.org/protobuf v1.26.0 CVE-2021-22570 High
libxml2 2.9.12-r1 2.9.13-r0 CVE-2022-23308 High
[~]
%

[k8s-ci-robot]

@longwuyuan: Reopened this issue.

In response to this:

/reopen

[~]
% docker images | grep -i "ingress-nginx/controller"
k8s.gcr.io/ingress-nginx/controller 7e5c1cecb086 2 weeks ago 286MB

% grype docker images | grep -i "ingress-nginx/controller" | awk '{print $3}'
✔ Vulnerability DB [updated]
New version of grype is available: 0.34.1
✔ Loaded image
✔ Parsed image
✔ Cataloged packages [113 packages]
✔ Scanned image [4 vulnerabilities]

NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
google.golang.org/protobuf v1.27.1 CVE-2015-5237 High
google.golang.org/protobuf v1.27.1 CVE-2021-22570 High
libxml2 2.9.12-r1 2.9.13-r0 CVE-2022-23308 High
[~]
% grype k8s.gcr.io/ingress-nginx/controller:v0.50.0@sha256:f46fc2d161c97a9d950635acb86fb3f8d4adcfb03ee241ea89c6cde16aa3fdf8
✔ Vulnerability DB [no update available]
New version of grype is available: 0.34.1
✔ Pulled image
✔ Loaded image
✔ Parsed image
✔ Cataloged packages [115 packages]
✔ Scanned image [6 vulnerabilities]

NAME INSTALLED FIXED-IN VULNERABILITY SEVERITY
github.com/opencontainers/runc v1.0.1 1.0.3 GHSA-v95c-p5hm-xq8f Medium
github.com/prometheus/client_golang v1.11.0 CVE-2022-21698 High
google.golang.org/protobuf v1.26.0 CVE-2015-5237 High
google.golang.org/protobuf v1.26.0 CVE-2021-22570 High
libxml2 2.9.12-r1 2.9.13-r0 CVE-2022-23308 High
[~]
%

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

@strongjz @rikatz @tao12345666333 , now there are 2 CVEs . This one and #8339 requiring a new base image and promotion.

/priority important-short-term

[k8s-ci-robot]

@longwuyuan: The label(s) priority/important-short-term cannot be applied, because the repository doesn't have them.

In response to this:

@strongjz @rikatz @tao12345666333 , now there are 2 CVEs . This one and #8339 requiring a new base image and promotion.

/priority important-short-term

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[longwuyuan]

/priority important-soon

[strongjz]

patched in https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v.1.1.3

/close

[k8s-ci-robot]

@strongjz: Closing this issue.

In response to this:

patched in https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v.1.1.3

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.