Go crypto vulnerability

[thomas9911]

Environment info

• noobaa-operator: 5.17.1
• Platform: (tested on) Ubuntu + Alpine

Actual behavior

When running trivy on an image that has the noobaa-operator installed:

trivy image -s CRITICAL --exit-code 1 --no-progress --ignore-unfixed image-with-noobaa-operator

usr/local/bin/noobaa-operator (gobinary)

Total: 1 (CRITICAL: 1)

┌─────────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                         Title                          │
├─────────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2024-45337 │ CRITICAL │ v0.26.0           │ 0.31.0        │ golang.org/x/crypto/ssh: Misuse of                     │
│                     │                │          │                   │               │ ServerConfig.PublicKeyCallback may cause authorization │
│                     │                │          │                   │               │ bypass in golang.org/x/crypto                          │
│                     │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2024-45337             │
└─────────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────┘

Expected behavior

Noobaa uses crypto >= 0.31.0

Steps to reproduce

1. copy noobaa-operator in a folder
2. run echo -e "from scratch\nadd noobaa-operator noobaa-operator" > Dockerfile
3. run docker build -t noobaa-crypto .
4. run trivy image -s CRITICAL --exit-code 1 --no-progress --ignore-unfixed noobaa-crypto

More information - Screenshots / Logs / Other output