Open security vulnerabilities on the latest fluent-bit version

[mansingcollis]

There are a few vulnerabilities detected against the latest version i.e. with the Trivy Scan Tool. The list is as below. Do you have any plans to remediate in the immediate future, please?
High: CVE-2024-26462 (Library: libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0)
High: CVE-2023-2953
Critical: CVE-2023-45853

Thanks.

[patrick-stephens]

All of these are marked as won't fix and from the base image. Fluent Bit cannot resolve them and the upstream maintainers have indicated they will not fix them for whatever reason. I would have a look at the analysis for them to check the impact and mitigation.

If it is an issue for you I would suggest building from source and disabling the relevant plugins that need those libraries along with removing them from the base image.

Please also reach out for security issues via the policy: https://github.com/fluent/fluent-bit/security/policy