Aws Inspector Findings - (High severity) in cloudwatch-agent go binary

[avosper-intellaegis]

After installing the cloudwatch agent into a container image using a Dockerfile from an Ubuntu based image (from these instructions) and uploading it into Aws ECR, the Inspector service is identifying 5 High severity security issues within the installed go binary for the cloudwatch-agent:

One of these there is a published fix for which the cloudwatch-agent utility could possibly be updated to use:

• https://snyk.io/vuln/SNYK-GOLANG-GOPKGINYAMLV3-2952714

Two of these are identified as having no current published resolutions:

• https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMKARDIANOSSERVICE-2774700
• GHSA-xm99-6pv5-q363

Two of these appear to be an issue w/ identifying the version correctly (ticket currently opened w/ Aws Support for this):

• https://snyk.io/vuln/SNYK-GOLANG-GOPKGINYAMLV3-2841557
  • Identifies Installed version / Fixed version 0:v3.0.0-20210107192922-496545a6307b/ 3.0.0
• https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXCRYPTO-1083910
  • Identifies Installed version / Fixed version 0:v0.0.0-20220315160706-3147a52a75dd/ 0.0.0

Dockerfile used to build container image uploaded to Aws ECR for Inspector scanning:

FROM ubuntu:20.04

ENV DEBIAN_FRONTEND noninteractive

RUN apt -y update && \
    yes "Y" | DEBIAN_FRONTEND=noninteractive apt -y upgrade && \
    apt-get install -y ca-certificates curl && \
    rm -rf /var/lib/apt/lists/*

RUN curl -O https://s3.amazonaws.com/amazoncloudwatch-agent/debian/amd64/latest/amazon-cloudwatch-agent.deb && \
    dpkg -i -E amazon-cloudwatch-agent.deb && \
    rm -rf /tmp/* && \
    rm -rf /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard && \
    rm -rf /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl && \
    rm -rf /opt/aws/amazon-cloudwatch-agent/bin/config-downloader

RUN apt clean all

ENV RUN_IN_CONTAINER="True"
ENTRYPOINT ["/opt/aws/amazon-cloudwatch-agent/bin/start-amazon-cloudwatch-agent"]

[SaxyPandaBear]

The kardianos finding is not valid. kardianos/service#289 (comment)