Nginx-ingress-controller 1.6.4 is flagged as critical vulnerable image

[abdulhubbali]

What scanner and version reported the CVE?
Internal Tool

What CVE was reported in the scanner findings?
GO (Go) Security Update for golang.org/x/net (GHSA-vvpx-j8f3-3w6h)

What versions of the controller did you test with?
Nginx-ingress-controller 1.6.4

Please provider other details that will help us determine the severity of the issue
GO (Go) Security Update for golang.org/x/net (GHSA-vvpx-j8f3-3w6h)
GHSA-vvpx-j8f3-3w6h

[longwuyuan]

We are already on x/net v0.8

ingress-nginx/go.mod

Line 104 in 2324ad0

golang.org/x/net v0.8.0 // indirect

/remove-kind bug

We are updaring go to v1.20 in the next release of the controller

[strongjz]

We're working on a new release to upgrade to golang 1.20 and alpine 3.17.2, there are several steps involved in that, and there are issues with the CI currently.

We have to first upgrade our build and testing image to golang 1.20, upgrade the nginx base container image and update the ingress-controller container go.mod; then, we can release an updated version.

#9743

#9747

kubernetes/k8s.io#4929

[strongjz]

/kind feature
/priority important-critical
/triage accepted

[k8s-ci-robot]

@strongjz: The label(s) priority/important-critical cannot be applied, because the repository doesn't have them.

In response to this:

/kind feature
/priority important-critical
/triage accepted

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[abdulhubbali]

I am consuming the contents directly from path ingress-nginx/charts/ingress-nginx (https://github.com/kubernetes/ingress-nginx/tree/main/charts/ingress-nginx) and the scans show golang.org/x/net v0.5.0 is detected. No Specific reference to go,mod file were made.

[strongjz]

It will be updated in the next release. Please be patient https://github.com/kubernetes/ingress-nginx/blob/main/go.mod#L104

[abdulhubbali]

Sure. Thanks for the update

[strongjz]

fixed in https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.7.0

/close

[k8s-ci-robot]

@strongjz: Closing this issue.

In response to this:

fixed in https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.7.0

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.