Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

CRITICAl vulnerability storage-initializer:0.7.0

See original GitHub issue

/kind bug

Hi team

Our tool shows following crtical vulnerability for storage-initializer:0.7.0. I checked release notes for 0.8.0 but couldn’t find any refence of any fix. Are there any plans to fix the vulnerability?

CVE-2021-44228

https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2021-44228

</body> </html>

What steps did you take and what happened: [A clear and concise description of what the bug is.]

What did you expect to happen:

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

Istio Version:
Knative Version:
KFServing Version:
Kubeflow version:
Kfdef:[k8s_istio/istio_dex/gcp_basic_auth/gcp_iap/aws/aws_cognito/ibm]
Minikube version:
Kubernetes version: (use kubectl version):
OS (e.g. from /etc/os-release):

Issue Analytics

State:
Created a year ago
Comments:13 (6 by maintainers)

Top GitHub Comments

2reactions

psheorangithubcommented, Jul 8, 2022

@andyi2it @yuzisun Thanks for making the changes. Could you please confirm which KServe release this fix goes into and when?

0reactions

spots107commented, Jul 8, 2022

This there anything that @psheorangithub or I can do to assist with this getting included in the next KServe release? We are keen to get this closed out.

Top Results From Across the Web

CVE-2022-42475: Critical Unauthenticated Remote Code ...

FortiGuard Labs has confirmed at least one instance of the vulnerability being exploited in the wild and included the current indicators of ...

Known Exploited Vulnerabilities Catalog | CISA

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require ...

Vulnerability Metrics - NVD

The Common Vulnerability Scoring System (CVSS) is a method used to supply a qualitative measure of severity. CVSS is not a measure of...

Incoming OpenSSL critical fix: Organizations, users, get ready!

The OpenSSL Project team has announced the release of OpenSSL version 3.0.7, which will fix a critical vulnerability, so prepare asap.

Qualys Research Alert: OpenSSL 3.0.7 - What You Need To ...

These vulnerabilities only apply to OpenSSL 3.x. Both these vulnerabilities are rated as HIGH and downgraded from CRITICAL as initially rated in ...