Create list of CVEs for Kubeflow 1.11 release

[mvlassis]

Context

For this cycle, we should create a detailed list of vulnerabilities for all images included in the 1.11 release of Charmed Kubeflow

What needs to get done

• Gather list of images
• Run these scripts using the specified images

Definition of Done

• A spreadsheet of vulnerabilities according to the specified format

[syncronize-issues-to-jira]

Thank you for reporting your feedback to us!

The internal ticket has been created: https://warthogs.atlassian.net/browse/KF-8463.

This message was autogenerated

[mvlassis]

Gathering list of images

The list of images was produced by running the tools/get-images.sh script located on bundle_kubeflow repository for the 1.11 Kubeflow bundle. Compared to the list of images produced in https://warthogs.atlassian.net/browse/KF-7903 (previous cycle). Note that:

• We are not including feast images from https://github.com/canonical/feast-operators because this vulnerability report is for the Kubeflow 1.11 release.
• We are including ubuntu/grafana:9-22.04 and ubuntu/prometheus:2-22.04 used in observability (the rock versions were found by looking at the metadata in the correct track of respective charm repositories)
• We are including charmedkubeflow/knative-eventing-job-sink:1.16.1-1c33b95 which was not detected by tools/get-images.sh in kfp-operators
• We are including docker.io/charmedkubeflow/tensorflow:2.5.1-2836bb9 which was not detected in the kubeflow-tensorboards-operator get-images.sh script
• We are included the upstream image docker.io/istio/install-cni:1.28.0, which is used for installing the Istio CNI plugin

Producing final report

To produce the final report, I ran python produce_report.py images.txt --exceptions exceptions.xlsx --tickets tickets.xlsx in the scripts/generate_cves directory of the bundle_kubeflow repository, after providing the following files:

• known_exploited_vulnerabilities.csv with the KEVs, which I got from https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• exceptions.xlsx with a list of known exceptions, which I got from https://docs.google.com/spreadsheets/d/1wIPrpKPdm4QVR0XyOtPRkAWU0kqLUb2x/edit?usp=drive_link&ouid=106637444762362243511&rtpof=true&sd=true
• tickets.xlsx with tickets and their CVEs, which I got from https://docs.google.com/spreadsheets/d/1jBoL3Itc2SEgJdukd4rASOd01r9vXhRv/edit?usp=drive_link&ouid=106637444762362243511&rtpof=true&sd=true