CVE-2022-2625

[ilichigor]

Hi. I've made a security-check for official fluentbit images and it founds a lot of CVEs. My biggest concern is CVE-2022-2625. See the example:

trivy i --severity HIGH,CRITICAL --security-checks vuln fluent/fluent-bit
2022-09-20T08:19:29.670Z	INFO	Vulnerability scanning is enabled
2022-09-20T08:19:33.365Z	INFO	Detected OS: debian
2022-09-20T08:19:33.365Z	INFO	Detecting Debian vulnerabilities...
2022-09-20T08:19:33.400Z	INFO	Number of language-specific files: 0

fluent/fluent-bit (debian 11.4)
===============================
Total: 4 (HIGH: 4, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬───────────────────┬─────────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Installed Version │  Fixed Version  │                            Title                            │
├─────────────┼────────────────┼──────────┼───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ libc6       │ CVE-2021-3999  │ HIGH     │ 2.31-13+deb11u3   │ 2.31-13+deb11u4 │ glibc: Off-by-one buffer overflow/underflow in getcwd()     │
│             │                │          │                   │                 │ https://avd.aquasec.com/nvd/cve-2021-3999                   │
├─────────────┼────────────────┤          ├───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ libcom-err2 │ CVE-2022-1304  │          │ 1.46.2-2          │                 │ e2fsprogs: out-of-bounds read/write via crafted filesystem  │
│             │                │          │                   │                 │ https://avd.aquasec.com/nvd/cve-2022-1304                   │
├─────────────┼────────────────┤          ├───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ libgcrypt20 │ CVE-2021-33560 │          │ 1.8.7-6           │                 │ libgcrypt: mishandles ElGamal encryption because it lacks   │
│             │                │          │                   │                 │ exponent blinding to address a...                           │
│             │                │          │                   │                 │ https://avd.aquasec.com/nvd/cve-2021-33560                  │
├─────────────┼────────────────┤          ├───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ libpq5      │ CVE-2022-2625  │          │ 13.7-0+deb11u1    │                 │ postgresql: Extension scripts replace objects not belonging │
│             │                │          │                   │                 │ to the extension.                                           │
│             │                │          │                   │                 │ https://avd.aquasec.com/nvd/cve-2022-2625                   │
└─────────────┴────────────────┴──────────┴───────────────────┴─────────────────┴─────────────────────────────────────────────────────────────┘

[lecaros]

Hi @ilichigor,
We do not ship any version of PostgreSQL. We rely on what's installed in the host. Let us know if you need further clarification on this.
You're most welcome to report any security-related issue as per our Security Policy.

Thanks!