ECR detected this vulnerabilities in alpine CVE-2020-28928 CVE-2016-4074

[valentinalmiron]

Hi team,

Just for your information we pushed the latest image on ECR and detected these vulns:

• CVE-2016-4074
• CVE-2020-28928

Later run Trivy images and detected only the follow:

• CVE-2022-0778 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0778)

Best,

[chen-keinan]

@valentinalmiron thank you for this input , will check it out.

[rgoltz]

Hi @chen-keinan & @valentinalmiron, Since you are using ECR based Scanning of AWS and Alpine, I'd to like to pint out to aws/containers-roadmap#1715

We currently see the same issue for CVE-2020-28928, which is a false positive: I've added some more details on the background for ECR-Scanning and I'm going to link our discussion here.

[chen-keinan]

Hi @rgoltz,
Thank you for the input.

CVE-2022-0778 - has been fixed with the latest image release of kube-bench v0.6.7.

I have just tested, kube-bench v0.6.7 , again with Trivy and found a new vulnerability CVE-2022-28391.

I have opened issue #1158 for it and fixed it with the next release.
FYI @valentinalmiron

[chen-keinan]

@rgoltz @valentinalmiron kube-bench v0.6.8 has been released and it includes the fixes for the vulnerabilities