fluent-bit critical vulnerabilty not detected

[pradyumnaparalikar]

Discussed in #6793

^{Originally posted by pradyumnaparalikar May 27, 2024}

IDs

CVE-2024-4323

Description

fluent-bit component for log processing. There was CRITICAL 9.8 CVE discovered in the application recently - https://fluentbit.io/blog/2024/05/21/statement-on-cve-2024-4323-and-its-fix/

The problem is that trivy isn’t detecting fluent-bit being installed in the container image and thus not reporting the issue. This problem can be easily replicated by running trivy scanner locally:

Reproduction Steps

trivy i cr.fluentbit.io/fluent/fluent-bit:2.1.4 -s CRITICAL

Target

Container Image

Scanner

Vulnerability

Target OS

No response

Debug Output

trivy i cr.fluentbit.io/fluent/fluent-bit:2.1.4 -s CRITICAL

Version

Version:v0.44.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[github-actions]

Please see https://aquasecurity.github.io/trivy/latest/community/contribute/issue/