Docker image 7.38.0-jmx has critical vulnerability CVE-2022-1996

[tarys]

Steps to reproduce the issue:

trivy image --severity CRITICAL datadog/agent:7.38.0-jmx

Output:

...
opt/datadog-agent/bin/agent/agent (gobinary)

Total: 1 (CRITICAL: 1)

┌────────────────────────────────┬───────────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability │ Severity │  Installed Version   │ Fixed Version │                            Title                             │
├────────────────────────────────┼───────────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful │ CVE-2022-1996 │ CRITICAL │ v2.16.0+incompatible │ v3.8.0        │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                │               │          │                      │               │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
└────────────────────────────────┴───────────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

opt/datadog-agent/embedded/bin/process-agent (gobinary)

Total: 1 (CRITICAL: 1)

┌────────────────────────────────┬───────────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability │ Severity │  Installed Version   │ Fixed Version │                            Title                             │
├────────────────────────────────┼───────────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful │ CVE-2022-1996 │ CRITICAL │ v2.16.0+incompatible │ v3.8.0        │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                │               │          │                      │               │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
└────────────────────────────────┴───────────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

opt/datadog-agent/embedded/bin/security-agent (gobinary)

Total: 1 (CRITICAL: 1)

┌────────────────────────────────┬───────────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability │ Severity │  Installed Version   │ Fixed Version │                            Title                             │
├────────────────────────────────┼───────────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful │ CVE-2022-1996 │ CRITICAL │ v2.16.0+incompatible │ v3.8.0        │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                │               │          │                      │               │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
└────────────────────────────────┴───────────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

opt/datadog-agent/embedded/bin/system-probe (gobinary)

Total: 1 (CRITICAL: 1)

┌────────────────────────────────┬───────────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability │ Severity │  Installed Version   │ Fixed Version │                            Title                             │
├────────────────────────────────┼───────────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful │ CVE-2022-1996 │ CRITICAL │ v2.16.0+incompatible │ v3.8.0        │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                │               │          │                      │               │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
└────────────────────────────────┴───────────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

opt/datadog-agent/embedded/bin/trace-agent (gobinary)

Total: 1 (CRITICAL: 1)

┌────────────────────────────────┬───────────────┬──────────┬──────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability │ Severity │  Installed Version   │ Fixed Version │                            Title                             │
├────────────────────────────────┼───────────────┼──────────┼──────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/emicklei/go-restful │ CVE-2022-1996 │ CRITICAL │ v2.16.0+incompatible │ v3.8.0        │ go-restful: Authorization Bypass Through User-Controlled Key │
│                                │               │          │                      │               │ https://avd.aquasec.com/nvd/cve-2022-1996                    │
└────────────────────────────────┴───────────────┴──────────┴──────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Describe what happened:
Trivy scan reports critical vulnerability

Describe what you expected:
Trivy scan reports no critical vulnerabilities

Additional environment details (Operating System, Cloud provider, etc):
N/A

[tarys]

If I got it right, currently used version of go-restful lib is 2.16.0:
https://github.com/DataDog/datadog-agent/blob/7.38.0/go.mod#L253

[sgnn7]

Hi @tarys!
As far as I know, this finding is not applicable to go-restful v2.16+ (relevant agent PR). You can see the fix in go-restful's 2.16.0's tag upstream history that includes the use exact matching of allowed domain entries commit. My guess is just that the scan tools don't currently have the latest fix ranges of versions.

I'll close this issue for now as it seems invalid but feel free to reopen it if you feel otherwise.