Aad-pod-identity: Image vulnerabilities in 1.6.2

[arianmotamedi]

Describe the bug
Latest (1.6.2) mic and nmi images are being flagged internally (S360) for these two vulnerabilities:

Debian Security Update for apt (DSA 4685-1)
Debian Security Update for gnutls28 (DSA 4697-1)

Steps To Reproduce
None - base image vulnerability issue.

AAD Pod Identity version
1.6.2

Kubernetes version
1.16.10

Additional context
How often do the images build? Is it possible to run them once or twice a day, similar to how .net core's images are built specifically for addressing base image vulnerabilities? I tried to find the pipeline that builds/pushes these on Azure DevOps to trigger it myself but only found the nightly build pipeline.

[chewong]

Hi @arianmotamedi, I opened https://github.com/Azure/aad-pod-identity/pull/783 to address those vulnerabilities. I also noticed in S360 that most of the images that got flagged were created during our e2e test pipelines, which were deleted right after the test is finished running.

[arianmotamedi]

Thanks Ernest! I'll keep watching the status of this PR. S360 is flagging official images for us, and they're out of compliance. Hopefully we can get this in soon :)

[arianmotamedi]

Hey @chewong, it doesn't look like the official images for mic and nmi in mcr.microsoft.com/k8s/aad-pod-identity were built using the latest base image. Can you trigger a build please?

[chewong]

We are planning to include the base image change in our next release (v1.6.3) and not planning to overwrite/rebuild old images. We will advise users to upgrade to v1.6.3 to avoid those vulnerabilities. Please let me know if you have any concerns about this.

[arianmotamedi]

When will 1.6.3 be released? Asking because we'd need this information if we need to get an exception for the flagged vulnerabilities since they're out of SLA :-)

[chewong]

We are expecting to release v1.6.3 by the end of this week

[arianmotamedi]

Hey @chewong, I see that 1.6.3 is released, but doesn't look like its image is pushed to mcr:

$ docker pull mcr.microsoft.com/k8s/aad-pod-identity/nmi:1.6.3
Error response from daemon: manifest for mcr.microsoft.com/k8s/aad-pod-identity/nmi:1.6.3 not found: manifest unknown: manifest tagged by "1.6.3" is not found

Could you take a look please?

[chewong]

We have moved the images to a different repo. Could you try mcr.microsoft.com/oss/azure/aad-pod-identity/nmi:v1.6.3?