Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Update node version, reduce CVE's #269

Merged
merged 1 commit into from
Apr 18, 2024
Merged

fix: Update node version, reduce CVE's #269

merged 1 commit into from
Apr 18, 2024

Conversation

jweak
Copy link
Contributor

@jweak jweak commented Apr 17, 2024

Customer reported vulnerability CVE-2023-4911 is found in bored-agent

This is not present in node:18-bullseye-slim

Running trivy with old vs new:

OLD node:16-bullseye-slim:

quay.io/k8slens/bored-agent:0.11.0 (debian 11.7)
================================================
Total: 150 (UNKNOWN: 0, LOW: 76, MEDIUM: 39, HIGH: 33, CRITICAL: 2)

Node.js (node-pkg)
==================
Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 7, HIGH: 1, CRITICAL: 0)

NEW node:18-bullseye-slim:

new-bored:latest (debian 11.9)
==============================
Total: 128 (UNKNOWN: 0, LOW: 74, MEDIUM: 32, HIGH: 20, CRITICAL: 2)

Node.js (node-pkg)
==================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

Installed locally built image to a cluster and tested the connection through spaces. Worked fine.

Fixes https://github.com/lensapp/lens-desktop-monorepo/issues/2326

@jweak jweak added bug Something isn't working docker Pull requests that update Docker code labels Apr 17, 2024
@jweak jweak requested review from jakolehm and a team April 17, 2024 11:33
@jweak jweak merged commit ae94469 into main Apr 18, 2024
3 checks passed
@jweak jweak deleted the update-node-image branch April 18, 2024 05:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working docker Pull requests that update Docker code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants