Vulnerability Issue

[satya-devloper]

  ## 👋  Welcome to Strimzi Discussions!

We want to use Discussions instead of the Question type issues. The discussions provide much better format for questions than the issues. They for example:

• Make it easier for other users with similar problems to chime in
• Unlike issues they do not need to be closed
• Do not mix with bugs and enhancements and make it easier for us to track and fix those

You could of course also use our #strimzi Slack channel or out user mailing list.

Please also make sure to follow our Code of Conduct.

Originally posted by @scholzj in #4099

[satya-devloper]

Hi @scholz , I m using this strimzi kafka image (quay.io/strimzi/kafka:0.32.0- kafka -3.2.0) in my project .But I m getting lots of vulnerabilities. Like 6 unaddressed vulnerability in golang, 7 vulnerability in rhel and many more with with 1 or 2 vulnerability. Plz suggest which image should I use so that I can get less vulnerability

[satya-devloper]

Go version of what?

Means somehow (quay.io/strimzi/kafka:0.29.0- kafka -3.2.0) this image is internally using golang version of 1.17.1. But after upgrade it is picking the version 1.19 , but still 1.19 version of golang has CVE defects

[scholzj]

As you can see, the bridge is not using CentOS 7: https://github.com/strimzi/strimzi-kafka-bridge/blob/3e08e474ee224715ba7fb28aa9deb945a376ebfd/Dockerfile#L1 ... as for the golang, you really need to be more precise what exactly are you talking about.

[satya-devloper]

Thanks a lot, somehow I was looking at https://github.com/strimzi/strimzi-kafka-bridge/tree/81e8c76c2293d4b83b63059bff4b9371064b03bf, this unluckily which is very older.
Can you plz provide some steps in order to build the image from source. So that I can replace the required version of application so that defect should not come in our project

[scholzj]

Please read the developer docs to learn how to build the project.

[satya-devloper]

Sure will check, Thanks for your reply.