Test CVE's for QG (Short Notice)

[jzbmw]

FIX:

• https://github.com/catenax-ng/tx-item-relationship-service/security/code-scanning/706 (706)
• https://github.com/catenax-ng/tx-item-relationship-service/security/code-scanning/663
• https://github.com/catenax-ng/tx-item-relationship-service/security/code-scanning/708 (708)

[ds-ext-kmassalski]

Expat library is not under our control, it is inside eclipse-temurin image, that we are using in Dockerfile.

It is possible to manually update expat in the container with below command:
RUN apk add --upgrade --no-cache expat
however this is not acceptable by System team, which decision is to put OSS over security:
https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-02/#use-base-image-as-is

Taking the above into account, we can only wait until there is a new eclipse-temurin image with an upgraded version of the expat library (probably soon, as JDK is already patched, waiting for JRE).

CSRF security finding was fixed.

[mkanal]

@ds-ext-kmassalski Please inform DevSecOps Team to be aware that this is located in eclipse-temurin image, and we do not have any troubles regarding this in QG. Thanks. In addition, please take this to the DevSecOps hour tomorrow.

fyi
@jzbmw @ds-jhartmann @ds-ext-sceronik @almadigabor @pablosec @SebastianBezold @scherersebastian

[SebastianBezold]

Hi @ds-ext-kmassalski and @mkanal,

We can definitely talk about it in the office hour again. Just to leave it here as well. @ds-ext-kmassalski is right with what he got from our TRG 4.02. We do indeed use base images as is, without any change.
The base images we aligned on are official ones on DockerHub.
DockerHub is doing container scans for them and is publishing the results in docker-library/repo-info. For our annotations in the "Notice for Docker images", we rely on that info being present. Altering the base image will render these scan results obsolete and our info in the notice wouldn't be correct anymore.

Up until now, there is no process on updating previously released images, in case a vulnerability is fixed in the base image. So if you have any suggestion on such a process, that is overwriting image tags, feel free to suggest it in the office hours or the mailing list

[mkanal]

Finds were fixed and migration documented - aligned with devSecOps Team