Может кто-нибудь посоветовать, как исправить уязвимости, обнаруженные Klar, с помощью сканера Clair для моего образа Azure ACR. Я еще новичок в работе с контейнерами.
Вот образец результата от Клара
CVE-2019-18348: [Medium]
Found in: python3.5 [3.5.2-2ubuntu0~16.04.9]
Fixed By: 3.5.2-2ubuntu0~16.04.10
An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-18348
-----------------------------------------
CVE-2019-20838: [Medium]
Found in: pcre3 [2:8.38-3.1]
Fixed By:
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-20838
-----------------------------------------
CVE-2020-14155: [Medium]
Found in: pcre3 [2:8.38-3.1]
Fixed By:
libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-14155
-----------------------------------------
CVE-2020-8617: [Medium]
Found in: bind9 [1:9.10.3.dfsg.P4-8ubuntu1.15]
Fixed By: 1:9.10.3.dfsg.P4-8ubuntu1.16
Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-8617
-----------------------------------------
CVE-2020-8616: [Medium]
Found in: bind9 [1:9.10.3.dfsg.P4-8ubuntu1.15]
Fixed By: 1:9.10.3.dfsg.P4-8ubuntu1.16
A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-8616
-----------------------------------------
CVE-2016-2775: [Medium]
Found in: bind9 [1:9.10.3.dfsg.P4-8ubuntu1.15]
Fixed By:
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2775
-----------------------------------------