Clean up all current vulnerabilities.

[nachogiljaldo]

This cleans up the CVEs both in the dependencies and the docker image.

To do so:

• bumps golang to 1.24
• bumps Sarama to the latest version

Also, I would really appreciate if you could generate a new image 🙏

Before:

jose@jose-GL65-Leopard-10SEK:~/Documents/jose/dev/opensource/kafka_exporter$ trivy image kafka-exporter:master ; docker run -v ${PWD}:/grafana-com aquasec/trivy repository --scanners vuln . --include-dev-deps
2025-02-15T14:35:32+01:00	INFO	[vuln] Vulnerability scanning is enabled
2025-02-15T14:35:32+01:00	INFO	[secret] Secret scanning is enabled
2025-02-15T14:35:32+01:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-02-15T14:35:32+01:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation for faster secret detection
2025-02-15T14:35:32+01:00	INFO	Number of language-specific files	num=1
2025-02-15T14:35:32+01:00	INFO	[gobinary] Detecting vulnerabilities...
2025-02-15T14:35:32+01:00	WARN	Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/v0.59/docs/scanner/vulnerability#severity-selection for details.

bin/kafka_exporter (gobinary)

Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 2, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ CRITICAL │ fixed  │ v0.26.0           │ 0.31.0                       │ golang.org/x/crypto/ssh: Misuse of                           │
│                     │                │          │        │                   │                              │ ServerConfig.PublicKeyCallback may cause authorization       │
│                     │                │          │        │                   │                              │ bypass in golang.org/x/crypto                                │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45337                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2024-45338 │ HIGH     │        │ v0.28.0           │ 0.33.0                       │ golang.org/x/net/html: Non-linear parsing of                 │
│                     │                │          │        │                   │                              │ case-insensitive content in golang.org/x/net/html            │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45338                   │
├─────────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib              │ CVE-2024-34156 │          │        │ v1.23.0           │ 1.22.7, 1.23.1               │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                     │                │          │        │                   │                              │ which contains deeply nested structures...                   │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
│                     ├────────────────┼──────────┤        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-34155 │ MEDIUM   │        │                   │                              │ go/parser: golang: Calling any of the Parse functions        │
│                     │                │          │        │                   │                              │ containing deeply nested literals...                         │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34155                   │
│                     ├────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-34158 │          │        │                   │                              │ go/build/constraint: golang: Calling Parse on a "// +build"  │
│                     │                │          │        │                   │                              │ build tag line with...                                       │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34158                   │
│                     ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-45336 │          │        │                   │ 1.22.11, 1.23.5, 1.24.0-rc.2 │ golang: net/http: net/http: sensitive headers incorrectly    │
│                     │                │          │        │                   │                              │ sent after cross-domain redirect                             │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45336                   │
│                     ├────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2024-45341 │          │        │                   │                              │ golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can │
│                     │                │          │        │                   │                              │ bypass URI name...                                           │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45341                   │
│                     ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                     │ CVE-2025-22866 │          │        │                   │ 1.22.12, 1.23.6, 1.24.0-rc.3 │ crypto/internal/nistec: golang: Timing sidechannel for P-256 │
│                     │                │          │        │                   │                              │ on ppc64le in crypto/internal/nistec                         │
│                     │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2025-22866                   │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘
2025-02-15T13:35:32Z	INFO	[vulndb] Need to update DB
2025-02-15T13:35:32Z	INFO	[vulndb] Downloading vulnerability DB...
2025-02-15T13:35:32Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
991.15 KiB / 59.22 MiB [>____________________________________________________________] 1.63% ? p/s ?6.03 MiB / 59.22 MiB [------>_______________________________________________________] 10.18% ? p/s ?9.33 MiB / 59.22 MiB [--------->____________________________________________________] 15.75% ? p/s ?12.84 MiB / 59.22 MiB [---------->_____________________________________] 21.69% 19.78 MiB p/s ETA 2s16.91 MiB / 59.22 MiB [------------->__________________________________] 28.55% 19.78 MiB p/s ETA 2s21.50 MiB / 59.22 MiB [----------------->______________________________] 36.30% 19.78 MiB p/s ETA 1s27.17 MiB / 59.22 MiB [---------------------->_________________________] 45.88% 20.05 MiB p/s ETA 1s31.14 MiB / 59.22 MiB [------------------------->______________________] 52.58% 20.05 MiB p/s ETA 1s36.17 MiB / 59.22 MiB [----------------------------->__________________] 61.08% 20.05 MiB p/s ETA 1s41.62 MiB / 59.22 MiB [--------------------------------->______________] 70.29% 20.31 MiB p/s ETA 0s46.06 MiB / 59.22 MiB [------------------------------------->__________] 77.78% 20.31 MiB p/s ETA 0s50.08 MiB / 59.22 MiB [---------------------------------------->_______] 84.56% 20.31 MiB p/s ETA 0s55.16 MiB / 59.22 MiB [-------------------------------------------->___] 93.13% 20.45 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 20.45 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 20.45 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 19.57 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 19.57 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 19.57 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 18.31 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 18.31 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [-------------------------------------------------] 100.00% 15.22 MiB p/s 4.1s2025-02-15T13:35:37Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-02-15T13:35:37Z	INFO	[vuln] Vulnerability scanning is enabled
2025-02-15T13:35:37Z	INFO	Number of language-specific files	num=1
2025-02-15T13:35:37Z	INFO	[gomod] Detecting vulnerabilities...

grafana-com/go.mod (gomod)
==========================
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                         Title                          │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ CRITICAL │ fixed  │ v0.26.0           │ 0.31.0        │ golang.org/x/crypto/ssh: Misuse of                     │
│                     │                │          │        │                   │               │ ServerConfig.PublicKeyCallback may cause authorization │
│                     │                │          │        │                   │               │ bypass in golang.org/x/crypto                          │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45337             │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2024-45338 │ HIGH     │        │ v0.28.0           │ 0.33.0        │ golang.org/x/net/html: Non-linear parsing of           │
│                     │                │          │        │                   │               │ case-insensitive content in golang.org/x/net/html      │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45338             │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────┘

After:

jose@jose-GL65-Leopard-10SEK:~/Documents/jose/dev/opensource/kafka_exporter$ trivy image kafka-exporter:security-fixes ; docker run -v ${PWD}:/grafana-com aquasec/trivy repository --scanners vuln . --include-dev-deps
2025-02-15T14:35:14+01:00	INFO	[vuln] Vulnerability scanning is enabled
2025-02-15T14:35:14+01:00	INFO	[secret] Secret scanning is enabled
2025-02-15T14:35:14+01:00	INFO	[secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2025-02-15T14:35:14+01:00	INFO	[secret] Please see also https://aquasecurity.github.io/trivy/v0.59/docs/scanner/secret#recommendation for faster secret detection
2025-02-15T14:35:14+01:00	INFO	Number of language-specific files	num=1
2025-02-15T14:35:14+01:00	INFO	[gobinary] Detecting vulnerabilities...
2025-02-15T13:35:14Z	INFO	[vulndb] Need to update DB
2025-02-15T13:35:14Z	INFO	[vulndb] Downloading vulnerability DB...
2025-02-15T13:35:14Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
2.20 MiB / 59.22 MiB [-->____________________________________________________________] 3.72% ? p/s ?6.36 MiB / 59.22 MiB [------>_______________________________________________________] 10.74% ? p/s ?10.37 MiB / 59.22 MiB [---------->__________________________________________________] 17.52% ? p/s ?14.81 MiB / 59.22 MiB [------------>___________________________________] 25.01% 21.04 MiB p/s ETA 2s19.03 MiB / 59.22 MiB [--------------->________________________________] 32.13% 21.04 MiB p/s ETA 1s23.27 MiB / 59.22 MiB [------------------>_____________________________] 39.28% 21.04 MiB p/s ETA 1s27.70 MiB / 59.22 MiB [---------------------->_________________________] 46.78% 21.07 MiB p/s ETA 1s32.14 MiB / 59.22 MiB [-------------------------->_____________________] 54.27% 21.07 MiB p/s ETA 1s36.75 MiB / 59.22 MiB [----------------------------->__________________] 62.05% 21.07 MiB p/s ETA 1s41.92 MiB / 59.22 MiB [--------------------------------->______________] 70.79% 21.24 MiB p/s ETA 0s46.73 MiB / 59.22 MiB [------------------------------------->__________] 78.91% 21.24 MiB p/s ETA 0s51.69 MiB / 59.22 MiB [----------------------------------------->______] 87.28% 21.24 MiB p/s ETA 0s56.86 MiB / 59.22 MiB [---------------------------------------------->_] 96.01% 21.48 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 21.48 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 21.48 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 20.34 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 20.34 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 20.34 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [---------------------------------------------->] 100.00% 19.03 MiB p/s ETA 0s59.22 MiB / 59.22 MiB [-------------------------------------------------] 100.00% 15.87 MiB p/s 3.9s2025-02-15T13:35:19Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2025-02-15T13:35:19Z	INFO	[vuln] Vulnerability scanning is enabled
2025-02-15T13:35:19Z	INFO	Number of language-specific files	num=1
2025-02-15T13:35:19Z	INFO	[gomod] Detecting vulnerabilities...

[danielqsj]

/lgtm thanks @nachogiljaldo