fix: Added vulnerability fixes for gorestlful gopkg & OS vulnerabilities in golang:1.20-alpine3.16

[Jonsy13]

Motivation

We at LitmusChaos are using Argo-Workflows for orchestrating Chaos Experiments. We want to upgrade to latest version of Argo-Workflows & currently it's v3.4.9. On scanning via Twistlock, we found some vulnerabilities due to an old version of go - go1.20.4 & one due to an older version of go package - https://github.com/emicklei/go-restful/v3.

On checking, found that Dockerfile is using golang:1.20-alpine3.16, which is using go1.20.4. There are some vulnerabilities which were fixed in latest version i.e. 1.20.5. Looks like golang:1.20-alpine3.16 is not getting build with latest version of go anymore.

+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
|       CVE        | SEVERITY | CVSS |              PACKAGE              | VERSION |          STATUS          | PUBLISHED  | DISCOVERED |                    DESCRIPTION                     |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-29405   | critical | 9.80 | go                                | 1.20.4  | fixed in 1.20.5, 1.19.10 | 59 days    | < 1 hour   | The go command may execute arbitrary code at build |
|                  |          |      |                                   |         | 51 days ago              |            |            | time when using cgo. This may occur when running   |
|                  |          |      |                                   |         |                          |            |            | \"go get\" on a malicious module, or when running  |
|                  |          |      |                                   |         |                          |            |            | ...                                                |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-29404   | critical | 9.80 | go                                | 1.20.4  | fixed in 1.20.5, 1.19.10 | 59 days    | < 1 hour   | The go command may execute arbitrary code at build |
|                  |          |      |                                   |         | 51 days ago              |            |            | time when using cgo. This may occur when running   |
|                  |          |      |                                   |         |                          |            |            | \"go get\" on a malicious module, or when running  |
|                  |          |      |                                   |         |                          |            |            | ...                                                |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-29402   | critical | 9.80 | go                                | 1.20.4  | fixed in 1.20.5, 1.19.10 | 59 days    | < 1 hour   | The go command may generate unexpected code at     |
|                  |          |      |                                   |         | 51 days ago              |            |            | build time when using cgo. This may result in      |
|                  |          |      |                                   |         |                          |            |            | unexpected behavior when running a go program      |
|                  |          |      |                                   |         |                          |            |            | which uses ...                                     |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-29403   | high     | 7.80 | go                                | 1.20.4  | fixed in 1.20.5, 1.19.10 | 59 days    | < 1 hour   | On Unix platforms, the Go runtime does not         |
|                  |          |      |                                   |         | 52 days ago              |            |            | behave differently when a binary is run with       |
|                  |          |      |                                   |         |                          |            |            | the setuid/setgid bits. This can be dangerous in   |
|                  |          |      |                                   |         |                          |            |            | certain cases...                                   |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| PRISMA-2022-0227 | high     | 7.50 | github.com/emicklei/go-restful/v3 | v3.8.0  | fixed in v3.10.0         | > 1 years  | < 1 hour   | github.com/emicklei/go-restful/v3 module prior     |
|                  |          |      |                                   |         | > 9 months ago           |            |            | to v3.10.0 is vulnerable to Authentication Bypass  |
|                  |          |      |                                   |         |                          |            |            | by Primary Weakness. There is an inconsistency in  |
|                  |          |      |                                   |         |                          |            |            | how...                                             |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-2253    | high     | 7.00 | github.com/docker/distribution    | v2.8.1  | fixed in 2.8.2-beta.1    | 61 days    | < 1 hour   | A flaw was found in the `/v2/_catalog` endpoint    |
|                  |          |      |                                   |         | 87 days ago              |            |            | in distribution/distribution, which accepts a      |
|                  |          |      |                                   |         |                          |            |            | parameter to control the maximum number of records |
|                  |          |      |                                   |         |                          |            |            | retur...                                           |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| CVE-2023-29406   | medium   | 6.50 | go                                | 1.20.4  | fixed in 1.20.6, 1.19.11 | 26 days    | < 1 hour   | The HTTP/1 client does not fully validate the      |
|                  |          |      |                                   |         | 18 days ago              |            |            | contents of the Host header. A maliciously crafted |
|                  |          |      |                                   |         |                          |            |            | Host header can inject additional headers or       |
|                  |          |      |                                   |         |                          |            |            | entire r...                                        |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+
| PRISMA-2023-0056 | medium   | 6.20 | github.com/sirupsen/logrus        | v1.9.2  | fixed in v1.9.3          | > 3 months | < 1 hour   | The github.com/sirupsen/logrus module of all       |
|                  |          |      |                                   |         | > 5 months ago           |            |            | versions is vulnerable to denial of service.       |
|                  |          |      |                                   |         |                          |            |            | Logging more than 64kb of data in a single entry   |
|                  |          |      |                                   |         |                          |            |            | without new...                                     |
+------------------+----------+------+-----------------------------------+---------+--------------------------+------------+------------+----------------------------------------------------+

Modifications

I have updated Base Image in Dockerfile to golang:1.20-alpine3.18 (This is having latest version of go i.e. 1.20.5).
Also updated version of https://github.com/emicklei/go-restful/v3 to v3.10.0.

Verification

[gdsoumya]

LGTM

[toyamagu-2021]

Hi, your tests fail because it reaches 25 min time limit.
The limit will be raised to 30 min after #11535 merged.