CVE(s) found

[github-actions]

Latest buildpacksio/pack v0.32.1 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/pack/actions/runs/7203611321

[prashantrewar]

Hey @jjbustamante, I am interested in this issue and want to try and I am new to this project. Could you please guide me on this and tell me in which library CVE(s) are present?

[jjbustamante]

Hi @prashantrewar

We are pleased with your interest on helping us with this issue, but I think it is actually a straight forward one. Our CI tooling uses grype to analyze the latest pack version looking for vulnerabilities.

If you run the scanning the pack image you will see the following:

We are already aware that we need to update the buildkit library, but we are pinning the version here because Docker added a new field in the Health Check structure and the new field ** StartInterval** is not being replicated in ggcr. We actually need a new ggcr version with the field in order to fix this issue

[prashantrewar]

Thank you @jjbustamante for your guidance, I have a question related to ggcr.

Is there any Issue or PR related to adding the new field ** StartInterval ** in the Health Check structure in ggcr library or should I create a new issue?

[jjbustamante]

I think there is not issue or PR there yet, I was planning to open a PR but I wanted to validate with someone from the community first

[prashantrewar]

I think there is not issue or PR there yet, I was planning to open a PR but I wanted to validate with someone from the community first

@jjbustamante, Should I communicate with someone from the community?

[jjbustamante]

Hi @prashantrewar

No, don't worry. there is a new version of kaniko 1.20.1 that bumped buildkit version, it was already merged in the lifecycle and once a new lifecycle version is available we will be able to get the update on pack and this CVEs will be solved. I think it is just a matter of time

[prashantrewar]

Thank you @jjbustamante

I am new to this project and want to understand and contribute more. Could you please suggest some more issue?