vulnerabilities CVE-2021-28918 and CVE-2019-0228 blocking CI builds

[JessicaBarh]

New vulnerabilities detected on container scan. These have been temporarily added to .github/containerscan/allowedlist.yaml so we can allow a successful CI run for the current images being used in production but the vulnerabilities need to be handled.

• CVE-2021-28918: upstream issue opened code-server 3.9.3 vulnerabilities  coder/code-server#3185. Will be fixed in code-server v3.10.0
• CVE-2019-0228: coming from libpodfbox-java which is a dependency for texlive-xetex which is installed in the docker-stacks upstream image here. Need to find a fix or a version of texlive-xetex that can resolve this
• CVE-2021-23334: look into a solution for this one. (false positive?)
• ml-metadata causing build errors

[JessicaBarh]

Issue:
texlive-xetex is dependant on texlive-xetex-extra which depends on libpdfbox-java (source of the vulnerability). the vulnerability has been fixed in libpdfbox2-java but there are no signs or plans of texlive-xetex supporting that version yet.

Why do we need texlive-xetex?
required by Nbconvert for converting notebooks to PDF

libpdfbox-java is a java library which is probably not used by anyone since we do not support java in our notebooks.

options:

1. uninstall libpdfbox-java without removing it's dependents (this was tested in a jupyterlab-cpu notebook using test_nbconvert.py and converting notebooks to PDF is functional)

2. leave as is and add the vulnerability to the allowedlist.yaml assuming no one uses this java library and the vulnerability is not a threat

[blairdrummond]

@justbert would be interested in your thoughts

[justbert]

Me?! Why ME!? Unfortunately, I'm super unfamiliar with the uses and these systems. :\

This is definitely that place where it's difficult to navigate the tightrope between maintainability and security. From conversations with @zachomedia, it might be a good time to start defining a clearer framework when it comes to situations like these within the AAW, since at a certain point, the risk must be accepted or actions must be taken to mitigate it, which may cause maintainability issues in the long run.

Sorry I'm not super helpful :(

[brendangadd]

@JessicaBarh Option (1) please. :) And let's make sure the issue is raised with docker-stacks and keep an eye on it. Once they resolve the issue upstream, we can revert and use their approach.