Security Alert: 1.16.22

[soloio-bot]

quay.io/solo-io/access-logger:1.16.22

No Vulnerabilities Found for quay.io/solo-io/access-logger:1.16.22 (alpine 3.17.6)

Vulnerabilities Listed for usr/local/bin/access-logger

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

quay.io/solo-io/certgen:1.16.22

No Vulnerabilities Found for quay.io/solo-io/certgen:1.16.22 (alpine 3.17.6)

Vulnerabilities Listed for usr/local/bin/certgen

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

quay.io/solo-io/discovery:1.16.22

No Vulnerabilities Found for quay.io/solo-io/discovery:1.16.22 (alpine 3.17.6)

Vulnerabilities Listed for usr/local/bin/discovery

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-36621	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36621
CVE-2024-36623	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36623
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

quay.io/solo-io/gloo:1.16.22

No Vulnerabilities Found for quay.io/solo-io/gloo:1.16.22 (ubuntu 20.04)

Vulnerabilities Listed for usr/local/bin/gloo

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-36621	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36621
CVE-2024-36623	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36623
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

quay.io/solo-io/gloo-envoy-wrapper:1.16.22

No Vulnerabilities Found for quay.io/solo-io/gloo-envoy-wrapper:1.16.22

quay.io/solo-io/ingress:1.16.22

No Vulnerabilities Found for quay.io/solo-io/ingress:1.16.22 (alpine 3.17.6)

Vulnerabilities Listed for usr/local/bin/ingress

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-36621	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36621
CVE-2024-36623	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36623
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

quay.io/solo-io/kubectl:1.16.22

No Vulnerabilities Found for quay.io/solo-io/kubectl:1.16.22

quay.io/solo-io/sds:1.16.22

No Vulnerabilities Found for quay.io/solo-io/sds:1.16.22 (alpine 3.17.6)

Vulnerabilities Listed for usr/local/bin/sds

Vulnerability ID	Package	Severity	Installed Version	Fixed Version	Reference
CVE-2024-36621	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36621
CVE-2024-36623	github.com/moby/moby	HIGH	v24.0.7+incompatible	26.0.0	https://avd.aquasec.com/nvd/cve-2024-36623
CVE-2024-45337	golang.org/x/crypto	CRITICAL	v0.17.0	0.31.0	https://avd.aquasec.com/nvd/cve-2024-45337

[ashishb-solo]

Fixed in https://github.com/solo-io/gloo/releases/tag/v1.16.23

[ashishb-solo]

Closed in error. The crypto vulnerability is fixed. the moby one is still not yet :-(

[sam-heilbron]

This has been released. As a result, future CVEs are tracked in the 1.16.23 issue