Describe the bug
Fluentd in any recent version depends on http_parser > 0.5.1, < 0.7.0. This has a transitive dependency on quite old library versions with known CVEs. Scanning a fluentd container with trivy shows:
usr/lib/ruby/gems/2.5.0/gems/http_parser.rb-0.6.0/Gemfile.lock
==============================================================
Total: 6 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 6, CRITICAL: 0)
+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+
| ffi | CVE-2018-1000201 | HIGH | 1.0.11 | 1.9.24 | ruby-ffi DDL loading |
| | | | | | issue on Windows OS |
| | | | | | -->avd.aquasec.com/nvd/cve-2018-1000201 |
+ + + +-------------------+ + +
| | | | 1.0.11-java | | |
| | | | | | |
| | | | | | |
+-----------+------------------+ +-------------------+---------------+-----------------------------------------+
| json | CVE-2020-10663 | | 1.8.0 | 2.3.0 | rubygem-json: Unsafe Object |
| | | | | | Creation Vulnerability in JSON |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-10663 |
+ + + +-------------------+ + +
| | | | 1.8.0-java | | |
| | | | | | |
| | | | | | |
+-----------+------------------+ +-------------------+---------------+-----------------------------------------+
| rake | CVE-2020-8130 | | 0.9.2 | 12.3.3 | rake: OS Command Injection |
| | | | | | via egrep in Rake::FileList |
| | | | | | -->avd.aquasec.com/nvd/cve-2020-8130 |
+-----------+------------------+ +-------------------+---------------+-----------------------------------------+
| yajl-ruby | CVE-2017-16516 | | 1.1.0 | 1.3.1 | rubygem-yajl-ruby: |
| | | | | | Yajl::Parser.new.parse |
| | | | | | incorrect parsing |
| | | | | | -->avd.aquasec.com/nvd/cve-2017-16516 |
+-----------+------------------+----------+-------------------+---------------+-----------------------------------------+
Describe the bug
Fluentd in any recent version depends on http_parser > 0.5.1, < 0.7.0. This has a transitive dependency on quite old library versions with known CVEs. Scanning a fluentd container with trivy shows: