Multiple vulnerabilities found in Docker image v6.7.7

[fredericdesroches]

Is this a support request?
No

Describe the bug
Hello, our open-source vulnerability scanner (Black Duck Binary Analysis) has detected 3 vulnerabilities in 3 libraries used by the ld-relay proxy.

Image used : https://hub.docker.com/layers/ld-relay/launchdarkly/ld-relay/6.7.7/images/sha256-b301c72e186dd63557b91a2bbe1f004c5f4bc8527f85441c6abe03a4283903b2?context=explore

"Component","Version","Latest version","CVE","Matching type","CVSS","CVE publication date","Object compilation date","Object","Object full path","Object SHA1","CVSS3","CVSS vector (v2)","CVSS vector (v3)","Distribution package","CVSS (Distribution)","CVSS3 (Distribution)","Triage vectors","Note type","Note reason","Vulnerability URL","Missing exploit mitigations"
"curl","7.79.1-r0","7.83.1","CVE-2022-27778","Exact match","5.8","2022-06-02T14:15:00Z","2021-09-22T18:50:51Z","libcurl.so.4.7.0","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/lib/libcurl.so.4.7.0","a7ea4b5a0fc234af6e180ada4f800f2857b20116","8.1","AV:N/AC:M/Au:N:/C:N/I:P/A:P","AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-27778","no-fortify-source"
"curl","7.79.1-r0","7.83.1","CVE-2022-27778","Exact match","5.8","2022-06-02T14:15:00Z","2021-09-22T18:50:51Z","curl","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/bin/curl","17406c39eafc0570b2af0dbe7c3089973d9c9235","8.1","AV:N/AC:M/Au:N:/C:N/I:P/A:P","AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-27778",""
"curl","7.79.1-r0","7.83.1","CVE-2022-22576","Exact match","5.5","2022-05-26T17:15:00Z","2021-09-22T18:50:51Z","libcurl.so.4.7.0","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/lib/libcurl.so.4.7.0","a7ea4b5a0fc234af6e180ada4f800f2857b20116","8.1","AV:N/AC:L/Au:S:/C:P/I:P/A:N","AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-22576","no-fortify-source"
"curl","7.79.1-r0","7.83.1","CVE-2022-22576","Exact match","5.5","2022-05-26T17:15:00Z","2021-09-22T18:50:51Z","curl","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/bin/curl","17406c39eafc0570b2af0dbe7c3089973d9c9235","8.1","AV:N/AC:L/Au:S:/C:P/I:P/A:N","AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-22576",""
"curl","7.79.1-r0","7.83.1","CVE-2022-27782","Exact match","5.0","2022-06-02T14:15:00Z","2021-09-22T18:50:51Z","libcurl.so.4.7.0","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/lib/libcurl.so.4.7.0","a7ea4b5a0fc234af6e180ada4f800f2857b20116","7.5","AV:N/AC:L/Au:N:/C:N/I:P/A:N","AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-27782","no-fortify-source"
"curl","7.79.1-r0","7.83.1","CVE-2022-27782","Exact match","5.0","2022-06-02T14:15:00Z","2021-09-22T18:50:51Z","curl","ld-relay:6.7.7.tar:19bd6ddda3eecd270cacd3133dc32d6df933b2449286e4ab6a71a099caa46944/layer.tar:usr/bin/curl","17406c39eafc0570b2af0dbe7c3089973d9c9235","7.5","AV:N/AC:L/Au:N:/C:N/I:P/A:N","AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-27782",""
"eventsource","v1.7.1","1.0.4","CVE-2022-1650","Exact match","5.8","2022-05-12T11:15:00Z","2022-05-10T21:14:28Z","ldr","ld-relay:6.7.7.tar:b6b6904f14033c35c407ad17ba718aded0113cb8d92ed21f420797749f9df58d/layer.tar:usr/bin/ldr","10a8edc8faedff6d9723d92d2cad06c7e26683e5","9.3","AV:N/AC:M/Au:N:/C:P/I:P/A:N","AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-1650",""
"openssl","1.1.1n-r0","3.0.3","CVE-2022-1292","Exact match","10.0","2022-05-03T16:15:00Z","2022-03-15T22:39:31Z","libcrypto.so.1.1","ld-relay:6.7.7.tar:8663204ce13b2961da55026a2034abb9e5afaaccf6a9cfb44ad71406dcd07c7b/layer.tar:lib/libcrypto.so.1.1","1d318b09e4396731f0257d39d2c10487bbe9219c","9.8","AV:N/AC:L/Au:N:/C:C/I:C/A:C","AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-1292","no-fortify-source"
"openssl","1.1.1n-r0","3.0.3","CVE-2022-1292","Exact match","10.0","2022-05-03T16:15:00Z","2022-03-15T22:39:31Z","libssl.so.1.1","ld-relay:6.7.7.tar:8663204ce13b2961da55026a2034abb9e5afaaccf6a9cfb44ad71406dcd07c7b/layer.tar:lib/libssl.so.1.1","c2ebde60dcdb3acf4115b3e0b71db0f24f731b77","9.8","AV:N/AC:L/Au:N:/C:C/I:C/A:C","AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-1292","no-fortify-source"

To reproduce
Scan docker image with Black Duck Binary Analysis

Expected behavior
ld-relay proxy should not contain vulnerable libraries. If not patchable, we would require an explanation as to why these vulnerabilities are not as severe as they look.

Logs
N/A

SDK version
N/A

Language version, developer tools
N/A

OS/platform
N/A

Additional context
N/A

[eli-darkly]

Thanks for this report. We're looking into these items and will respond shortly.

[eli-darkly]

The first six items, representing three vulnerabilities shared by libcurl and curl, look like they are not relevant to the Relay Proxy because the Relay Proxy, like all Go executables, does not use libcurl/curl in any way for HTTP requests but uses Go's own implementation of HTTP. In fact, it's unclear to me why curl is being installed in this image at all, and it may be that the best way for us to avoid such warnings is simply to remove it; I'm verifying that we can do so. If there is some non-historical reason why it's there, then we can patch it.

[eli-darkly]

CVE-2022-1650, shown in this list as a vulnerability of "eventsource v1.7.1", does not make sense to us in this context; we suspect there may be an error in the CVE database used by Black Duck, or in the logic it uses for determine which database entries are applicable.

The CVE's description (and the linked huntr.dev report) says it is about "GitHub repository eventsource/eventsource prior to v2.0.2". But https://github.com/eventsource/eventsource is a JavaScript library, and it is not referenced in any way in the Relay Proxy application (which contains no JavaScript code), or, as far as we can tell, by any other code in the ld-relay Docker image. So, while that CVE does seem plausible in itself in regard to that repository (whose most recent version is 2.0.2), it seems out of place here.

The Relay Proxy code does use an unrelated Go library (that is, unrelated in terms of implementation and platform; it is for a related purpose), https://github.com/launchdarkly/eventsource. And v1.7.1 is the version we are using of that, so the the Black Duck listing does seem to be referencing that version, but the actual CVE is clearly not referring to that. It's unclear whether there is any change we could make that would make Black Duck stop reporting it, since there is no such thing as a v2.0.2 version of the library we're using.

We'll continue to investigate this and, if it is an error by the scanner, we'll do our best to make Synopsys aware of it. Unfortunately, our last attempt to make them aware of a different error via their support forum (here) never received a response.

[eli-darkly]

Finally, regarding the OpenSSL vulnerability CVE-2022-1292, we believe this is not relevant to the Relay Proxy because the Go runtime uses its own TLS implementation rather than using OpenSSL. But since scanners will flag this as long as it is present in Alpine, we should update to an Alpine patch version that has newer versions of libcrypto/libssl— or, if no such patch is available, we will patch those libraries separately.

[eli-darkly]

To sum up: we don't believe any of these to represent real security vulnerabilities in a running Relay Proxy container, but we do intend to release a patch soon that should make the curl and OpenSSL-related warnings disappear. The warning about eventsource, we believe to be invalid but we do not currently know of a way to stop the warning from happening. If it remains as a known problem, we will open a new issue here specifically about that, to clarify the situation for other customers who may be using Black Duck.

[eli-darkly]

@fredericdesroches We've released version 6.7.8 with patches for all of these warnings except the eventsource one. Could you verify that your scanner is no longer showing these with the new release?

[fredericdesroches]

@eli-darkly Thank you very much for the swift response and analysis, very much appreciated! We will report the eventsource one as false positive as it is indeed not related to golang, but Javascript.

We will be upgrading to v6.7.8 as it patches the curl and openssl vulnerabilities. It does, however, bring a new vulnerability with busybox :

"busybox","1.35.0-r13","1.34.1","CVE-2022-30065","Exact match","6.8","2022-05-18T15:15:00Z","2022-05-09T17:27:12Z","ssl_client","modelt_launchdarkly_ld-relay:6.7.8.tar:2408cc74d12b6cd092bb8b516ba7d5e290f485d3eb9672efc00f0583730179e8/layer.tar:usr/bin/ssl_client","0baa80f1116de5e6a07ac6daaaee2995ce82b727","7.8","AV:N/AC:M/Au:N:/C:P/I:P/A:P","AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","alpine","","","","","","http://nvd.nist.gov/vuln/detail/CVE-2022-30065",""

It does seem to apply very much unless ld-relay uses awk?

Thank you again, Frederic

[eli-darkly]

Ugh, that's unfortunate about the busybox warning. That must be a CVE that exists in Alpine 3.16.0 and did not exist in 3.14.6— and there are no patches for 3.16.x yet, and I don't think it is possible to patch busybox separately since it's a core component of Alpine. But I think you're right that it is not relevant to Relay Proxy usage; the Docker image runs our ldr executable directly and we do not execute awk or any other Linux command after that. It would only be an issue if someone were able to shell into the running container and execute arbitrary shell commands in there, which would be a much bigger attack vector anyway.

It's also unfortunate that apparently Trivy— which is what we use for prerelease scanning, as well as re-scanning existing code for newly reported vulnerabilities— is not able to detect this vulnerability; normally we've been able to rely on Trivy for all CVEs related to things in the OS, it was just that it had a more limited ability to detect things inside Go code.

[eli-darkly]

We will keep an eye out for any Alpine 3.16.x patch and update to it as soon as available.

[eli-darkly]

Well, maybe it would be best for us to put out another patch which rolls the Alpine version back, and just separately updates the libcrypto and openssl packages. Using a newer Trivy that understands how to scan Alpine 3.16 (it looks to me like there was a lag in them implementing this, causing false negatives for that version), other CVEs showed up— again not ones that would plausibly affect the Relay Proxy, but still, we would rather be using a more thoroughly patched OS on principle.

[eli-darkly]

Unfortunately Alpine still has not released a patch for 3.16.0.

[fredericdesroches]

Hi @eli-darkly, what shall we do here? Should we close the issue as all of the initial vulnerable libraries have been patched and track the busybox one in a separate issue, or continue tracking it here?

Thanks, Frederic

[eli-darkly]

I'm fine with leaving this issue open; that makes it easier for anyone who noticed the same thing to track the work that's been done so far.

[eli-darkly]

By the way, the open issue for patching busybox in Alpine 3.16 is here: alpinelinux/docker-alpine#264

[eli-darkly]

Alpine 3.16.1 is out now and the release notes say that it fixes CVE-2022-30065; unfortunately, that turned out not to be accurate. It does not seem to be possible to patch the affected package directly (see link in my previous comment) so we will have to wait for 3.16.2 for that one. Once again, we do not see this as an actual vulnerability for a Relay Proxy instance, but we do want to make the warnings about this go away as soon as possible.

[eli-darkly]

We've released v6.7.11, which updates Alpine to 3.16.1. As mentioned in my previous comment, that patch may not actually have fixed this particular issue; at first Trivy was continuing to report the issue, and other developers have seen the same. However, Trivy is now saying the image is OK. The Alpine patch is desirable in any case.

When you have a chance to try the new image, could you please let us know whether your own scanner is now happy with it or not?

[fredericdesroches]

Hi @eli-darkly,

Everything is under control with v6.7.11! I suppose we can close this now?

Thanks a lot for the effort, Frederic

[eli-darkly]

Great - I guess there was just some kind of security database glitch earlier that was making it look like Alpine 3.16.1 didn't fix the busybox issue. So we're good, until the next inevitable CVE. I'll close this now.