Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cluster-autoscaler binary contains high and critical vulnerabilities #5343

Open
zhouke1991 opened this issue Nov 30, 2022 · 22 comments
Open

cluster-autoscaler binary contains high and critical vulnerabilities #5343

zhouke1991 opened this issue Nov 30, 2022 · 22 comments
Labels
area/cluster-autoscaler area/core-autoscaler Denotes an issue that is related to the core autoscaler and is not specific to any provider. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@zhouke1991
Copy link

zhouke1991 commented Nov 30, 2022 •
edited
Loading

There are lots of high and critical vulnerabilities that were scanned by trivy.
The scanning result of cluster-autoscaler:v1.23.0 is as follows, v1.22.0 and v1.24.0 are the same with it.

Vulnerability Severity Score Image Binary Dependency
CVE-2022-1996 critical 9.1 cluster-autoscaler:v1.23.0 cluster-autoscaler github.com/emicklei/go-restful
CVE-2021-44716 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler golang.org/x/net
CVE-2022-27664 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler golang.org/x/net
CVE-2022-21698 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler github.com/prometheus/client_golang
CVE-2021-43565 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler golang.org/x/crypto
CVE-2022-27191 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler golang.org/x/crypto
CVE-2022-32149 high 7.5 cluster-autoscaler:v1.23.0 cluster-autoscaler golang.org/x/text

My question is if there is a plan to fix these vulnerabilities on these versions(1.22, 1.23, 1.24)?
@zhouke1991 zhouke1991 added the kind/feature Categorizes issue or PR as related to a new feature. label Nov 30, 2022
@zhouke1991 zhouke1991 changed the title cluster-autoscaler images contain high and critical vulnerabilities cluster-autoscaler binary contain high and critical vulnerabilities Nov 30, 2022
@zhouke1991 zhouke1991 changed the title cluster-autoscaler binary contain high and critical vulnerabilities cluster-autoscaler binary contains high and critical vulnerabilities Nov 30, 2022
@WebSpider
Copy link
Contributor

Cluster-autoscaler uses gcr.io/distroless/static:nonroot-amd64 as it's base image.

Are those issues also present in the base image?

@gjtempleton
Copy link
Member

This repo also has a security policy with instructions for reporting security issues to the appropriate contacts for triage and response.

If you believe the answer to @WebSpider's question is yes, please follow the instructions there to report security issues.

@gjtempleton
Copy link
Member

We released a 1.23.1 release back in June as well, so you should run the same scan against that rather than 1.23.0.

@zhouke1991
Copy link
Author

@WebSpider @gjtempleton Thanks for replying. I think these CVEs are related to the golang dependencies but not the base image. Especially for the critical dependency "github.com/emicklei/go-restful", can you please verify if the autoscalser used it?

@yuyangbj
Copy link

@gjtempleton could you please guide how do we open a security issue for autoscaler repo? We found even for 1.24, autoscaler just released 1.24.0 around May. These CVEs are still suitable for them.

@yuyangbj
Copy link

And by the way, if we plan to submit the codes to fix them, when could we get the 1.24.1 release?

@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 21, 2023
@thegreya
Copy link

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 19, 2023
@elmiko
Copy link
Contributor

elmiko commented May 17, 2023

just leaving an update here, it appears these have all been fixed in more recent versions:

  • CVE-2022-1996
    • cluster-autoscaler now contains github.com/emicklei/go-restful/v3 v3.10.2
  • CVE-2021-44716
    • cluster-autoscaler now contains golang.org/x/net v0.9.0
  • CVE-2022-27664
    • cluster-autoscaler now contains golang.org/x/net v0.9.0
  • CVE-2022-21698
    • cluster-autoscaler now contains github.com/prometheus/client_golang v1.14.0
  • CVE-2021-43565
    • cluster-autoscaler now contains golang.org/x/crypto v0.8.0
  • CVE-2022-27191
    • cluster-autoscaler now contains golang.org/x/crypto v0.8.0
  • CVE-2022-32149
    • cluster-autscaler now contains golang.org/x/text v0.9.0

My question is if there is a plan to fix these vulnerabilities on these versions(1.22, 1.23, 1.24)?

i'm not sure how, or if, we can backport all of these, but i wanted to leave an update that they have been fixed in the most recent release (1.27.1)

@vadasambar
Copy link
Member

@elmiko thanks for the comment. We are at 1.23 which is EOL according to https://kubernetes.io/releases/
image

Guess I will start a thread and ask in #sig-autoscaling or raise this in the SIG meeting (not too hopeful about getting a patch for an EOL release).

@gjtempleton
Copy link
Member

gjtempleton commented May 25, 2023 •
edited
Loading

@yuyangbj The security policy for this repo, and other k8s repos is linked on the side of the root of the repo via the Github functionality, but can also currently be seen here.

As @vadasambar says, 1.23 has dropped out of support, and the critical vulnerability (github.com/emicklei/go-restful) listed has been pulled in from our vendoring of the upstream scheduler code. There's no version of 1.23 kubernetes/kubernetes using a more modern version of this library, you can see this from the go.sum. Even k8s 1.24 is still using this version of the library, and as such the v1.24.2 image I'm currently promoting is still marked by trivy as having a critical CVE.

As such we have no way of upgrading the CA 1.23 branch and publishing an image without this library without significant work (if it's even possible.)

We have adopted a new policy of publishing CA patch releases every 2 months, and are now updating our upstream k8s/k8s dependencies as standard as part of this process which should help us with shipping fewer libraries marked as vulnerabilities by automated scanners.

@vadasambar
Copy link
Member

vadasambar commented May 26, 2023 •
edited
Loading

@gjtempleton thanks for responding on this issue. Seems like it's not in our hands anymore for 1.23 and 1.24.

@vadasambar
Copy link
Member

vadasambar commented May 26, 2023 •
edited
Loading

For anyone wondering, you can check the vulnerabilities using CLI tool like grype:

$ grype registry.k8s.io/autoscaling/cluster-autoscaler:v1.23.1
 ✔ Vulnerability DB        [no update available]
 ✔ Pulled image            
 ✔ Loaded image            
 ✔ Parsed image            
 ✔ Cataloged packages      [114 packages]
 ✔ Scanning image...       [9 vulnerabilities]
   ├── 1 critical, 7 high, 1 medium, 0 low, 0 negligible
   └── 6 fixed

NAME                                 INSTALLED                           FIXED-IN                           TYPE       VULNERABILITY        SEVERITY 
github.com/emicklei/go-restful       v2.9.5+incompatible                 2.16.0                             go-module  GHSA-r48q-9g5r-8q2h  Critical  
github.com/prometheus/client_golang  v1.11.0                                                                go-module  CVE-2022-21698       High      
github.com/prometheus/client_golang  v1.11.0                             1.11.1                             go-module  GHSA-cg3q-j54f-5p7p  High      
golang.org/x/crypto                  v0.0.0-20220112180741-5e0467b6c7ce  0.0.0-20220314234659-1baeb1ce4c0b  go-module  GHSA-8c26-wmh5-6g9v  High      
golang.org/x/net                     v0.0.0-20220225172249-27dd8689420f  0.0.0-20220906165146-f3363e06e74c  go-module  GHSA-69cg-p879-7622  High      
golang.org/x/net                     v0.0.0-20220225172249-27dd8689420f  0.7.0                              go-module  GHSA-vvpx-j8f3-3w6h  High      
golang.org/x/text                    v0.3.7                              0.3.8                              go-module  GHSA-69ch-w2m2-3vjp  High  

go mod why -m github.com/emicklei/go-restful
# github.com/emicklei/go-restful
k8s.io/autoscaler/cluster-autoscaler
k8s.io/apiserver/pkg/server/routes
github.com/emicklei/go-restful

Seems like k8s.io/apiserver is the upstream dependency here we are using in the CA. 1.23 version of upstream kubernetes is using the v2.9.5+incompatible version of github.com/emicklei/go-restful

@sumitgupta21
Copy link

Would like to add that with scan tool Xray there are many more vulnerabilities reported in cluster-autoscaler v1.23.0 as well as v1.23.1

Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬───────────────────────────┬───────────────────────────┬──────┬────────────────┐
│ SEVERITY │ DIRECT                    │ DIRECT  │ IMPACTED                  │ IMPACTED                  │ FIXED                     │ TYPE │ CVE            │
│          │ PACKAGE                   │ PACKAGE │ PACKAGE                   │ PACKAGE                   │ VERSIONS                  │      │                │
│          │                           │ VERSION │ NAME                      │ VERSION                   │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Critical │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.8]                  │ Go   │ CVE-2023-24538 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Critical │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.9]                  │ Go   │ CVE-2023-24540 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Critical │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.16.14]                 │ Go   │ CVE-2022-23806 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.17.7]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Critical │ sha256__f394b6c5a905c5a48 │         │ github.com/emicklei/go-re │ 2.9.5+incompatible        │ [2.16.0]                  │ Go   │ CVE-2022-1996  │
│          │ b133e34a5539a385de3132d28 │         │ stful                     │                           │                           │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.9]                  │ Go   │ CVE-2023-29400 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.16.15]                 │ Go   │ CVE-2022-24921 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.17.8]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ gopkg.in/yaml.v3          │ 3.0.0-20210107192922-4965 │ [3.0.0]                   │ Go   │ CVE-2022-28948 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 45a6307b                  │                           │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/text         │ 0.3.7                     │ [0.3.8]                   │ Go   │ CVE-2022-32149 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │                           │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/crypto       │ 0.0.0-20210817164053-32db │ [0.0.0-20220314234659-1ba │ Go   │ CVE-2022-27191 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 794688a5                  │ eb1ce4c0b]                │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-30633 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-30632 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.8]                  │ Go   │ CVE-2023-24536 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-30631 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-28131 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.11]                 │ Go   │ CVE-2022-30580 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/net          │ 0.0.0-20210825183410-e898 │ [0.0.0-20220906165146-f33 │ Go   │ CVE-2022-27664 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 025ed96a                  │ 63e06e74c]                │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.9]                  │ Go   │ CVE-2023-24539 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.9]                  │ Go   │ CVE-2022-24675 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.1]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-30630 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.6]                  │ Go   │ CVE-2022-41724 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.1]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.6]                  │ Go   │ CVE-2022-41722 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.1]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.18.9]                  │ Go   │ CVE-2022-41720 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.19.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-30635 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.18.7]                  │ Go   │ CVE-2022-2880  │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.19.2]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.9]                  │ Go   │ CVE-2022-28327 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.1]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.13]                 │ Go   │ CVE-2022-32189 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.5]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/prometheus/cli │ 1.11.0                    │ [1.11.1]                  │ Go   │ CVE-2022-21698 │
│          │ b133e34a5539a385de3132d28 │         │ ent_golang                │                           │                           │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.16.14]                 │ Go   │ CVE-2022-23773 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.17.7]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.11]                 │ Go   │ CVE-2022-29804 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.6]                  │ Go   │ CVE-2022-41725 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.1]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.8]                  │ Go   │ CVE-2023-24534 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.11]                 │ Go   │ CVE-2022-30634 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/crypto       │ 0.0.0-20210817164053-32db │ [0.0.0-20211202192323-577 │ Go   │ CVE-2021-43565 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 794688a5                  │ 0296d904e]                │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ k8s.io/kubernetes         │ 1.23.0                    │ [1.22.14]                 │ Go   │ CVE-2021-25749 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.23.11]                 │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │ [1.24.5]                  │      │                │
│          │ r                         │         │                           │                           │ [1.25.0]                  │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.18.7]                  │ Go   │ CVE-2022-41715 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.19.2]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.16.14]                 │ Go   │ CVE-2022-23772 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.17.7]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/net          │ 0.0.0-20210825183410-e898 │ [0.7.0]                   │ Go   │ CVE-2022-41723 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 025ed96a                  │                           │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.8]                  │ Go   │ CVE-2023-24537 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.18.8]                  │ Go   │ CVE-2022-41716 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.19.3]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ High     │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.18.7]                  │ Go   │ CVE-2022-2879  │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.19.2]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ golang.org/x/sys          │ 0.0.0-20210831042530-f4d4 │ [0.0.0-20220412211240-33d │ Go   │ CVE-2022-29526 │
│          │ b133e34a5539a385de3132d28 │         │                           │ 3177bf5e                  │ a011f77ad]                │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-1705  │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.19.7]                  │ Go   │ CVE-2023-24532 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.20.2]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-1962  │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ github.com/golang/go      │ 1.17.5                    │ [1.17.12]                 │ Go   │ CVE-2022-32148 │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.18.4]                  │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │                           │      │                │
│          │ r                         │         │                           │                           │                           │      │                │
│          │                           │         │                           │                           │                           │      │                │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┼──────┼────────────────┤
│ Medium   │ sha256__f394b6c5a905c5a48 │         │ k8s.io/kubernetes         │ 1.23.0                    │ [1.22.14]                 │ Go   │ CVE-2022-3172  │
│          │ b133e34a5539a385de3132d28 │         │                           │                           │ [1.23.11]                 │      │                │
│          │ 939d8463c61c46e7b04537.ta │         │                           │                           │ [1.24.5]                  │      │                │
│          │ r                         │         │                           │                           │ [1.25.1]                  │      │                │
│          │                           │         │                           │                           │                           │      │                │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴───────────────────────────┴───────────────────────────┴──────┴────────────────┘

@fmulero
Copy link

fmulero commented Nov 3, 2023

Hi,

Most of the warnings reported are currently fixed but there a few still there:

──────────────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│                           Library                            │    Vulnerability    │ Severity │ Status │ Installed Version │              Fixed Version               │                            Title                             │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/net/http/otelht- │ CVE-2023-45142      │ HIGH     │ fixed  │ v0.40.0           │ 0.44.0                                   │ DoS vulnerability in otelhttp                                │
│ tp                                                           │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-45142                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┤          │        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net                                             │ CVE-2023-39325      │          │        │ v0.13.0           │ 0.17.0                                   │ rapid stream resets can cause excessive work                 │
│                                                              │                     │          │        │                   │                                          │ (CVE-2023-44487)                                             │
│                                                              │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                                                              ├─────────────────────┼──────────┤        │                   │                                          ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2023-44487      │ MEDIUM   │        │                   │                                          │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                                              │                     │          │        │                   │                                          │ attack (Rapid...                                             │
│                                                              │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ google.golang.org/grpc                                       │ GHSA-m425-mq94-257g │ HIGH     │        │ v1.54.0           │ 1.56.3, 1.57.1, 1.58.3                   │ gRPC-Go HTTP/2 Rapid Reset vulnerability                     │
│                                                              │                     │          │        │                   │                                          │ https://github.com/advisories/GHSA-m425-mq94-257g            │
│                                                              ├─────────────────────┼──────────┤        │                   ├──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2023-44487      │ MEDIUM   │        │                   │ 1.58.3, 1.57.1, 1.56.3                   │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                                                              │                     │          │        │                   │                                          │ attack (Rapid...                                             │
│                                                              │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
├──────────────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ k8s.io/kubernetes                                            │ CVE-2023-3676       │ HIGH     │        │ v1.28.0           │ 1.28.1, 1.27.5, 1.26.8, 1.25.13, 1.24.17 │ Insufficient input sanitization on Windows nodes leads to    │
│                                                              │                     │          │        │                   │                                          │ privilege escalation                                         │
│                                                              │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-3676                    │
│                                                              ├─────────────────────┤          │        │                   │                                          ├──────────────────────────────────────────────────────────────┤
│                                                              │ CVE-2023-3955       │          │        │                   │                                          │ Insufficient input sanitization on Windows nodes leads to    │
│                                                              │                     │          │        │                   │                                          │ privilege escalation                                         │
│                                                              │                     │          │        │                   │                                          │ https://avd.aquasec.com/nvd/cve-2023-3955                    │
└──────────────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

@fmulero
Copy link

fmulero commented Jan 14, 2024

Hi,

This is the report for the latest release:

┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH     │ fixed  │ v0.42.0           │ 0.46.0        │ opentelemetry-go-contrib: DoS vulnerability in otelgrpc due │
│ rg/grpc/otelgrpc                                             │                │          │        │                   │               │ to unbound cardinality metrics                              │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-47108                  │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto                                          │ CVE-2023-48795 │ MEDIUM   │        │ v0.14.0           │ 0.17.0        │ ssh: Prefix truncation attack on Binary Packet Protocol     │
│                                                              │                │          │        │                   │               │ (BPP)                                                       │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-48795                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────

Do you have any information about how you update the dependencies in your daily basis or in your release process?

@towca towca added the area/core-autoscaler Denotes an issue that is related to the core autoscaler and is not specific to any provider. label Mar 21, 2024
@Shubham82 Shubham82 mentioned this issue May 3, 2024
Closed
@Shubham82
Copy link
Contributor

Hi All,

JFI: The result for vulnerability scanning on the CA 1.30.0(latest version), used trivy for vulnerability scanning.


┌──────────────────────────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────────────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ go.opentelemetry.io/contrib/instrumentation/google.golang.o- │ CVE-2023-47108 │ HIGH     │ fixed  │ v0.42.0           │ 0.46.0        │ opentelemetry-go-contrib: DoS vulnerability in otelgrpc due │
│ rg/grpc/otelgrpc                                             │                │          │        │                   │               │ to unbound cardinality metrics                              │
│                                                              │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-47108                  │
└──────────────────────────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

@Shubham82 Shubham82 mentioned this issue Jun 3, 2024
Closed
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 1, 2024
@Shubham82
Copy link
Contributor

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Aug 1, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 30, 2024
@Shubham82
Copy link
Contributor

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 30, 2024
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/cluster-autoscaler area/core-autoscaler Denotes an issue that is related to the core autoscaler and is not specific to any provider. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests