Vulnerabilities in OpenSearch Container Scan (PRISMA scan) on v 2.3

Security
,
1

Describe the issue:
PRISMA scan (container scan) for open search (v2.3) and opensearch dashboard (v2.3) is showing 4 critical and 69 high vulnerabilites (for open search) and 4 critical and 55 high vulnerabilities (for open search dashboard) respectively.

Has this been addressed, is there any way to work around the same. We as an organization were planning to use this version for some of application being readied for production/UAT deployment.
Any suggestions in this regards would be highly helpful.

Configuration:
opensearch v2.3.0 and opensearchdashboard v2.3.0

Relevant Logs or Screenshots:
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

image
image1339×223 15.7 KB

-opensearch-operator/actions/runs/8631421902/job/23659795972#step:5:13)/actions-runner/_work/_tool/twistcli/32.04.112/x64/twistcli images scan --address *** --user *** --password *** --output-file pcc_scan_results.json --details ghcr.io//docker.io/opensearchproject/opensearch:2.3.0

Results -
Vulnerabilities found for image /docker.io/opensearchproject/opensearch:2.3.0: total - 179, critical - 4, high - 69, medium - 80, low - 26

Vulnerability threshold check results: FAIL

Scan failed due to vulnerability policy violations: Default - Rule for High and Critical, 73 vulnerabilities. Blocking vulnerabilities by severity OR by risk factors. Severity distribution : [high:39 important:30 critical:4]

2

hey @Rakesh1

Have you scanned OS v2.8.0?

3

Hi @Gsmitt - In fact, we did scan the version 2.13 (latest version) looking for any fixes, but seems like there are still a few, although much better compared to the version 2.3.
For example.
Vulnerabilities found for image /opensearchproject/opensearch:2.13.0: total - 103, critical - 1, high - 32, medium - 47, low - 23

[446]Vulnerability threshold check results: FAIL

[447]/actions/runs/8662094993/job/23753360662#step:5:448)Scan failed due to vulnerability policy violations: Default - Rule for High and Critical, 33 vulnerabilities. Blocking vulnerabilities by severity OR by risk factors. Severity distribution : [critical:1 high:20 important:12]

image
image1337×203 18.8 KB

Also, we have a detailed list of all the vulnerabilities and their possible mitigation. Would it be possible to engage with some of the core contributors/developers from open search and work with them to mitigate.

Thanks,
Rakesh.

1 Like