Vulnerability found in non-os package type (go) - /usr/local/bin/gosu (fixed in: 1.21.9, 1.22.2)(CVE-2023-45288 - https://nvd.nist.gov/vuln/detail/CVE-2023-45288)

[avikumar11]

finding Vulnerability found in non-os package type (go) - /usr/local/bin/gosu (fixed in: 1.21.9, 1.22.2)(GHSA-4v7x-pqxf-cx7m - https://nvd.nist.gov/vuln/detail/CVE-2023-45288) in influxdb Docker image.

[mgattozzi]

Tagging @jdstrand from the security team. @avikumar11 could you provide more information like which version of InfluxDB you scanned?

[avikumar11]

@mgattozzi @jdstrand : i am using latest version of influxdb docker image. there are others vul also,

1. Using root user to start the container
2. on which i mentioned in subject ( finding Vulnerability found in non-os package type (go) - /usr/local/bin/gosu (fixed in: 1.21.9, 1.22.2)(GHSA-4v7x-pqxf-cx7m - https://nvd.nist.gov/vuln/detail/CVE-2023-45288) in influxdb Docker image. )
3. Vulnerability found in non-os package type (go) - /usr/local/bin/dasel (fixed in: 1.21.8, 1.22.1)(CVE-2023-45289 - https://nvd.nist.gov/vuln/detail/CVE-2023-45289)
   there are few more. please scan it with anchore.

[jdstrand]

@mgattozzi - influxdb:latest currently refers to 2.7.11. Neither gosu or dasel are part of the 1.11 or Enterprise images.

The gosu shipped in influxdb:latest was compiled with go1.18.2 (eg, go version ./usr/local/bin/gosu) while dasel was compiled with go1.21.3. While it's true that these are compiled with older golangs that have since gotten CVE fixes, these are tools for parsing config files and dropping to the non-root user within the docker environment. The aforementioned CVEs deal with processing HTTP requests which neither of these tools do. As such, they don't affect influxdb.

@davidby-influx - while this is not a security issue in influxdb, it would be nice if we used more recent versions of gosu and dasel (see https://github.com/influxdata/influxdata-docker/blob/master/influxdb/2.7/Dockerfile) to reduce false positives in scanning tools. Adding security/misc as this isn't a vulnerability in and of itself.