Repository navigation
Latest version (v1.97.4) uses an old version of Terraform with critical vulns #835
Closed as not planned
Description
Describe the bug
The latest docker image (v1.97.4) is failing vuln scans due to old versions of Terraform (v1.10.5) and other tools that contain fixable vulnerabilities.
How can we reproduce it?
✔ docker run --rm --entrypoint bash -it ghcr.io/antonbabenko/pre-commit-terraform:v1.97.4
301615486d44:/# terraform version
Terraform v1.10.5
on linux_amd64
Your version of Terraform is out of date! The latest version
is 1.11.2. You can update by downloading from https://www.terraform.io/downloads.html
301615486d44:/#docker run -e REGISTRY_AUTH_FILE=/root/.docker/config.json -v /tmp/retag.OPhdEa:/root/.docker -v /var/run/docker.sock:/var/run/docker.sock -v /root/.wiz:/root/.wiz --rm wizcli:latest docker scan --file-hashes-scan --policy Block-Critical-Vulnerabilities-ECR-Image-Import --policy-hits-only --image ghcr.io/antonbabenko/pre-commit-terraform:v1.97.4
| _ _ _
| __ _(_)____ ___\| (_)
| \ \ /\ / / \|_ / / __\| \| \|
| \ V V /\| \|/ / \| (__\| \| \|
| \_/\_/ \|_/___\| \___\|_\|_\|
| Preparing to scan Docker image ghcr.io/antonbabenko/pre-commit-terraform:v1.97.4
| Creating temporary directory for image
| Getting scan parameters
| SUCCESS: Ready to scan Docker image ghcr.io/antonbabenko/pre-commit-terraform:v1.97.4
| Scanning Docker image ghcr.io/antonbabenko/pre-commit-terraform@sha256:78e1f8261fce4d569c07f486407ecfc326d3778f1a2154b51c8927ee6934dda7
| Scanning Docker image ghcr.io/antonbabenko/pre-commit-terraform:v1.97.4 with policies Block-Malware-ECR-Image-Import, Block-Critical-Vulnerabilities-ECR-Image-Import
| SUCCESS: Scanned Docker image
| Uploading scan results for analysis on Wiz
| Getting scan results
| SUCCESS: Docker image scan analysis ready
| OS Package vulnerabilities:
| Name: krb5-libs, Version: 1.20.1-r0
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-37371, Severity: CRITICAL, Source: https://security.alpinelinux.org/vuln/CVE-2024-37371
| CVSS score: 9.1, CVSS exploitability score: 3.9
| Fixed version: 1.20.2-r1
| Name: libexpat, Version: 2.5.0-r0
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45491, Severity: CRITICAL, Source: https://security.alpinelinux.org/vuln/CVE-2024-45491
| CVSS score: 9.8, CVSS exploitability score: 3.9
| Fixed version: 2.6.3-r0
| CVE-2024-45492, Severity: CRITICAL, Source: https://security.alpinelinux.org/vuln/CVE-2024-45492
| CVSS score: 9.8, CVSS exploitability score: 3.9
| Fixed version: 2.6.3-r0
|
| Library vulnerabilities:
| Name: mkdocs-material, Version: 8.2.14, Path: /root/.terrascan/docs/requirements.txt
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2023-50447, Severity: CRITICAL, Source: https://data.safetycli.com/v/64496/52d
| CVSS score: 8.1, CVSS exploitability score: 2.2
| Fixed version: 9.5.5
| Name: golang.org/x/crypto, Version: 0.0.0-20220525230936-793ad666bf5e, Path: /root/.terrascan/go.mod
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45337, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v778-237x-gjrc
| Fixed version: 0.31.0
| Name: github.com/go-git/go-git/v5, Version: 5.11.0, Path: /usr/bin/infracost
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2025-21613, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v725-9546-7q7m
| Fixed version: 5.13.0
| Name: golang.org/x/crypto, Version: 0.27.0, Path: /usr/bin/terraform
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45337, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v778-237x-gjrc
| Fixed version: 0.31.0
| Name: golang.org/x/crypto, Version: 0.27.0, Path: /usr/bin/terraform-docs
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45337, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v778-237x-gjrc
| Fixed version: 0.31.0
| Name: golang.org/x/crypto, Version: 0.0.0-20220525230936-793ad666bf5e, Path: /usr/bin/terrascan
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45337, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v778-237x-gjrc
| Fixed version: 0.31.0
| Name: golang.org/x/crypto, Version: 0.1.0, Path: /usr/bin/tfupdate
| Failed policy: Block-Critical-Vulnerabilities-ECR-Image-Import
| CVE-2024-45337, Severity: CRITICAL, Source: https://github.com/advisories/GHSA-v778-237x-gjrc
| Fixed version: 0.31.0
|
|
Activity
[-]Latest version (v1.97.4) uses an old version of Terraform[/-][+]Please release a new version that includes the latest version of Terraform[/+][-]Please release a new version that includes the latest version of Terraform[/-][+]Latest version (v1.97.4) uses an old version of Terraform with critical vulns[/+]yermulnik commentedon Mar 13, 2025
@davidarcher Thanks for bringing this up. I created #836 for this.
MaxymVlasov commentedon Mar 20, 2025
As expected. See #724 (comment) for details
If you want to create a new tag each time when any of tools release their new version - check #724 (comment)
If you have any other ideas how to make it work in idempotent or any other way except triggering hooks release each time or committing to support multiply versions at once - please let me know.
In theory, we could build
<pre-commit-terraform version>-latestevery week for latest, or few latest hooks versions depending on some condition, but it stilllatestso not make big difference fromnightlywhich we already have.P.S. hashicorp doesn't think that this vuln scan make any sense, otherwise they will be already backpush such changes to 1.10.6 to deal with that vuln.
https://github.com/hashicorp/terraform/tags
@yermulnik your PR totally make sense, but it is not related to this issue (as it not deal with root cause)
yermulnik commentedon Mar 20, 2025
Yep, thanks. I might had worded not clear enough: my PR was not to fix root cause, but to trigger rebuild of the container image (which sort of indirectly resolves this PR) 👍🏻
MaxymVlasov commentedon Mar 20, 2025
As another "hotfix", I will add docs to same PR that we are not responsible for issues in 3rd party, and that's users responsibility to manage their environment and dependencies if they want to use specific versions and not
nightly, as I see that it's not obvious enoughgithub-actions commentedon Apr 20, 2025
This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days
github-actions commentedon May 1, 2025
This issue was automatically closed because of stale in 10 days