Security Vulnerabilities faced in drift container images

[VijayRajVg]

Please find the list of CIB ID’s below:
CON-Image-CVE-2022-28391
CON-Image-CVE-2022-30065

[MaheshYadlapati]

Hi, looked at the Dockerfile — the runtime stage is alpine:3.21.2, which bundles BusyBox and is the source of both CVEs. CVE-2022-28391 is an RCE via BusyBox netstat (CVSS 8.8) and CVE-2022-30065 is a use-after-free in BusyBox awk, both fixed in Alpine 3.16.1+.

Since driftctl is a statically compiled Go binary with no runtime dependencies, the Alpine layer isn't needed at all. Swapping to distroless would eliminate BusyBox entirely:

dockerfile

FROM gcr.io/distroless/static AS runtime
COPY --from=builder /go/src/app/bin/driftctl_linux_amd64/driftctl /bin/driftctl
ENTRYPOINT ["/bin/driftctl"]