Fixable security vulnerabilities in 2.50.0

[sachams]

Release 2.50.0 has a number of Critical and High security vulnerabilities that can be fixed. These are showing up in our vulnerability reporting. Can they be addressed?

Here is the report obtained by running:

grype gcr.io/endpoints-release/endpoints-runtime:2.50.0 --only-fixed

NAME                        INSTALLED  FIXED-IN    TYPE       VULNERABILITY        SEVERITY 
google.golang.org/protobuf  v1.30.0    1.33.0      go-module  GHSA-8r3f-844c-mc37  Medium    
libcrypto3                  3.1.6-r0   3.1.7-r0    apk        CVE-2024-6119        High      
libexpat                    2.6.2-r0   2.6.3-r0    apk        CVE-2024-45492       Critical  
libexpat                    2.6.2-r0   2.6.3-r0    apk        CVE-2024-45491       Critical  
libexpat                    2.6.2-r0   2.6.3-r0    apk        CVE-2024-45490       Critical  
libssl3                     3.1.6-r0   3.1.7-r0    apk        CVE-2024-6119        High      
openssl                     3.1.6-r0   3.1.7-r0    apk        CVE-2024-6119        High      
pip                         23.1.2     23.3        python     GHSA-mq26-g339-26xf  Medium    
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2024-7592        High      
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2024-6232        High      
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2024-4032        High      
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2024-6923        Medium    
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2023-27043       Medium    
python3                     3.11.8-r0  3.11.8-r1   apk        CVE-2024-8088        Unknown   
python3                     3.11.8-r0  3.11.10-r0  apk        CVE-2015-2104        Unknown   
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2024-7592        High      
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2024-6232        High      
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2024-4032        High      
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2024-6923        Medium    
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2023-27043       Medium    
python3-pyc                 3.11.8-r0  3.11.8-r1   apk        CVE-2024-8088        Unknown   
python3-pyc                 3.11.8-r0  3.11.10-r0  apk        CVE-2015-2104        Unknown   
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2024-7592        High      
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2024-6232        High      
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2024-4032        High      
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2024-6923        Medium    
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2023-27043       Medium    
python3-pycache-pyc0        3.11.8-r0  3.11.8-r1   apk        CVE-2024-8088        Unknown   
python3-pycache-pyc0        3.11.8-r0  3.11.10-r0  apk        CVE-2015-2104        Unknown

[sachams]

Any thoughts on this?

[gopkarthik]

Thanks for bringing this up! Updating dependencies should fix the critical vulnerabilities. We'll create a new minor release (2.51.0) addressing this.

[sachams]

Hey @gopkarthik just checking in to see if you have had a chance to pick this up?

[sachams]

Hi @gopkarthik any update? These critical vulnerabilities are being flagged in our vulnerability reporting and are now becoming a problem for us. I would be grateful if you can take a look.

[sachams]

Hey @gopkarthik @paulhong01 any thoughts? Would be great to get an update out before the end of the year! 🎁 🎉

[paulhong01]

2.51 has been released. https://github.com/GoogleCloudPlatform/esp-v2/releases/tag/v2.51.0

[sachams]

Many thanks! I see the critical issues have been resolved - thanks! Do you plan to address the high issues?

grype gcr.io/endpoints-release/endpoints-runtime:2.51.0 --only-fixed

NAME                        INSTALLED   FIXED-IN                                  TYPE       VULNERABILITY        SEVERITY 
glibc                       2.34-r0     2.40                                      apk        CVE-2024-33602       High      
glibc                       2.34-r0     2.40                                      apk        CVE-2024-33601       High      
glibc                       2.34-r0     2.40                                      apk        CVE-2024-2961        High      
glibc                       2.34-r0     2.39                                      apk        CVE-2023-5156        High      
glibc                       2.34-r0     2.39                                      apk        CVE-2023-4911        High      
glibc                       2.34-r0     2.35                                      apk        CVE-2021-3998        High      
glibc                       2.34-r0     2.36                                      apk        CVE-2023-4813        Medium    
glibc                       2.34-r0     2.39                                      apk        CVE-2023-4527        Medium    
glibc                       2.34-r0     2.38                                      apk        CVE-2023-0687        Medium    
glibc                       2.34-r0     2.40                                      apk        CVE-2024-33600       Unknown   
glibc                       2.34-r0     2.40                                      apk        CVE-2024-33599       Unknown   
golang.org/x/net            v0.23.0     0.33.0                                    go-module  GHSA-w32m-9786-jp63  High      
google.golang.org/protobuf  v1.30.0     1.33.0                                    go-module  GHSA-8r3f-844c-mc37  Medium    
pip                         23.1.2      23.3                                      python     GHSA-mq26-g339-26xf  Medium    
py3-pip                     23.1.2-r0   23.3                                      apk        CVE-2023-5752        Medium    
python3                     3.11.10-r1  3.10.16, 3.11.11, 3.12.8, 3.13.1, 3.9.21  apk        CVE-2024-50602       Medium    
python3                     3.11.10-r1  3.11.11-r0                                apk        CVE-2024-9287        Unknown   
python3-pyc                 3.11.10-r1  3.11.11-r0                                apk        CVE-2024-9287        Unknown   
python3-pycache-pyc0        3.11.10-r1  3.11.11-r0                                apk        CVE-2024-9287        Unknown   
stdlib                      go1.22.5    1.22.7, 1.23.1                            go-module  CVE-2024-34158       High      
stdlib                      go1.22.5    1.22.7, 1.23.1                            go-module  CVE-2024-34156       High      
stdlib                      go1.22.5    1.22.7, 1.23.1                            go-module  CVE-2024-34155       Medium

[athomas]

The latest version 2.55 contains critical vulnerabilities:

grype gcr.io/endpoints-release/endpoints-runtime:2.55.0 --only-fixed
NAME                        INSTALLED  FIXED IN                          TYPE       VULNERABILITY        SEVERITY  EPSS           RISK   
stdlib                      go1.22.5   1.22.7, 1.23.1                    go-module  CVE-2024-34156       High      0.3% (52nd)    0.2    
google.golang.org/protobuf  v1.30.0    1.33.0                            go-module  GHSA-8r3f-844c-mc37  Medium    0.2% (45th)    0.1    
stdlib                      go1.22.5   1.22.7, 1.23.1                    go-module  CVE-2024-34158       High      0.2% (37th)    0.1    
stdlib                      go1.22.5   1.23.8, 1.24.2                    go-module  CVE-2025-22871       Critical  0.1% (30th)    0.1    
golang.org/x/oauth2         v0.7.0     0.27.0                            go-module  GHSA-6v2p-p543-phr9  High      0.1% (29th)    < 0.1  
stdlib                      go1.22.5   1.22.11, 1.23.5, 1.24.0-rc.2      go-module  CVE-2024-45336       Medium    0.1% (34th)    < 0.1  
stdlib                      go1.22.5   1.22.11, 1.23.5, 1.24.0-rc.2      go-module  CVE-2024-45341       Medium    0.1% (30th)    < 0.1  
golang.org/x/net            v0.23.0    0.38.0                            go-module  GHSA-vvgc-356p-c3xw  Medium    0.1% (30th)    < 0.1  
jaraco-context              5.3.0      6.1.0                             python     GHSA-58pv-8j8x-9vj2  High      < 0.1% (18th)  < 0.1  
stdlib                      go1.22.5   1.22.7, 1.23.1                    go-module  CVE-2024-34155       Medium    < 0.1% (23rd)  < 0.1  
envoy                       1.30.7     1.31.8, 1.32.6, 1.33.3, 1.34.1    binary     CVE-2025-46821       Medium    < 0.1% (19th)  < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-61723       High      < 0.1% (11th)  < 0.1  
stdlib                      go1.22.5   1.24.12, 1.25.6                   go-module  CVE-2025-61726       High      < 0.1% (9th)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-61725       High      < 0.1% (8th)   < 0.1  
envoy                       1.30.7     1.28.7, 1.29.9, 1.30.6, 1.31.2    binary     CVE-2024-45810       High      < 0.1% (8th)   < 0.1  
envoy                       1.30.7     1.33.12, 1.34.10, 1.35.6, 1.36.2  binary     CVE-2025-62504       High      < 0.1% (6th)   < 0.1  
stdlib                      go1.22.5   1.22.12, 1.23.6, 1.24.0-rc.3      go-module  CVE-2025-22866       Medium    < 0.1% (11th)  < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-58185       Medium    < 0.1% (9th)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-47912       Medium    < 0.1% (8th)   < 0.1  
stdlib                      go1.22.5   1.23.12, 1.24.6                   go-module  CVE-2025-47906       Medium    < 0.1% (7th)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-58186       Medium    < 0.1% (8th)   < 0.1  
github.com/golang/glog      v1.1.0     1.2.4                             go-module  GHSA-6wxm-mpqj-6jpf  Medium    < 0.1% (7th)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-58188       High      < 0.1% (4th)   < 0.1  
stdlib                      go1.22.5   1.24.9, 1.25.3                    go-module  CVE-2025-58187       High      < 0.1% (4th)   < 0.1  
stdlib                      go1.22.5   1.24.11, 1.25.5                   go-module  CVE-2025-61729       High      < 0.1% (3rd)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-61724       Medium    < 0.1% (5th)   < 0.1  
golang.org/x/net            v0.23.0    0.36.0                            go-module  GHSA-qxp5-gwg8-xv66  Medium    < 0.1% (6th)   < 0.1  
envoy                       1.30.7     1.33.10, 1.34.9, 1.35.5, 1.36.1   binary     CVE-2025-62409       High      < 0.1% (2nd)   < 0.1  
pip                         25.1.1     25.3                              python     GHSA-4xh5-x5gv-qwph  Medium    < 0.1% (5th)   < 0.1  
envoy                       1.30.7     1.30.10, 1.31.6, 1.32.4, 1.33.1   binary     CVE-2025-30157       High      < 0.1% (2nd)   < 0.1  
stdlib                      go1.22.5   1.23.10, 1.24.4                   go-module  CVE-2025-4673        Medium    < 0.1% (3rd)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-58183       Medium    < 0.1% (4th)   < 0.1  
stdlib                      go1.22.5   1.24.12, 1.25.6                   go-module  CVE-2025-61728       Medium    < 0.1% (3rd)   < 0.1  
stdlib                      go1.22.5   1.23.12, 1.24.6                   go-module  CVE-2025-47907       High      < 0.1% (1st)   < 0.1  
stdlib                      go1.22.5   1.24.8, 1.25.2                    go-module  CVE-2025-58189       Medium    < 0.1% (3rd)   < 0.1  
stdlib                      go1.22.5   1.24.13, 1.25.7, 1.26.0-rc.3      go-module  CVE-2025-68121       Critical  < 0.1% (0th)   < 0.1  
stdlib                      go1.22.5   1.24.12, 1.25.6                   go-module  CVE-2025-61731       High      < 0.1% (1st)   < 0.1  
stdlib                      go1.22.5   1.24.11, 1.25.5                   go-module  CVE-2025-61727       Medium    < 0.1% (1st)   < 0.1  
wheel                       0.45.1     0.46.2                            python     GHSA-8rrh-rw8j-w5fx  High      < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.32.10, 1.33.7, 1.34.5, 1.35.1   binary     CVE-2025-55162       High      < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.29.12, 1.30.9, 1.31.5, 1.32.3   binary     CVE-2024-53270       High      < 0.1% (0th)   < 0.1  
stdlib                      go1.22.5   1.24.13, 1.25.7                   go-module  CVE-2025-61732       High      < 0.1% (0th)   < 0.1  
pip                         25.1.1     26.0                              python     GHSA-6vgw-5pg2-w6jp  Low       < 0.1% (4th)   < 0.1  
stdlib                      go1.22.5   1.23.11, 1.24.5                   go-module  CVE-2025-4674        High      < 0.1% (0th)   < 0.1  
stdlib                      go1.22.5   1.24.12, 1.25.6                   go-module  CVE-2025-61730       Medium    < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.30.8, 1.31.4, 1.32.2            binary     CVE-2024-53269       High      < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.33.13, 1.34.11, 1.35.7, 1.36.3  binary     CVE-2025-64527       Medium    < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.33.13, 1.34.11, 1.35.7, 1.36.3  binary     CVE-2025-64763       Medium    < 0.1% (0th)   < 0.1  
stdlib                      go1.22.5   1.23.9, 1.24.3                    go-module  CVE-2025-22873       Low       < 0.1% (0th)   < 0.1  
envoy                       1.30.7     1.33.13, 1.34.11, 1.35.7, 1.36.3  binary     CVE-2025-66220       High      < 0.1% (0th)   < 0.1