vulnerability warnings in ld-relay 6.7.10 Docker image

[eli-darkly]

LD has opened this issue to let everyone know that we're aware of the following vulnerabilities being flagged by security scanners on our Docker image, and we will release a patch version of the Docker image to address these as soon as possible.

It's our policy to make any necessary dependency/platform updates for such issues no matter what, but we also look into the details to determine how much of an actual risk these represent, if any, to Relay Proxy installations that are currently running. Here is our analysis:

CVE-2022-30065: This is a vulnerability in the awk tool included in the Alpine Linux distribution that our Docker image uses. We do not believe this affects Relay Proxy instances, which never invoke awk; it would only be invoked if an attacker were already able to execute arbitrary commands in the container. (This was one of the CVEs previously mentioned in #191)

CVE-2022-21698: A vulnerability in the Prometheus metrics integration. We do not believe this affects Relay Proxy instances, even if Prometheus metrics are enabled, because the Relay Proxy does not use the Prometheus client in the ways mentioned in the CVE description. It definitely cannot affect Relay Proxy instances that do not have Prometheus metrics enabled.

CVE-2021-44716: A vulnerability in the Go runtime's implementation of HTTP/2. Maliciously crafted HTTP requests could cause uncontrolled memory consumption.

CVE-2022-29526: A Go runtime bug that has no obvious security implications (the symptom appears to be that an application might wrongly think it has permission to access a file, but that the file would still really not be accessible), but in any case should not affect Relay Proxy instances since this API is not being used.

[eli-darkly]

The 6.7.11 release fixes these issues— except possibly for CVE-2022-30065; there are reports that some security scanners do not consider this to be fixed in Alpine 3.16.1, even though according to our own latest sans, it is. We will continue to monitor for reports.