6 Critical security vulnerabilities for ckan-solr/2.10-solr9 & 2.11-solr9 images

[alice-boe]

The below vulnerabilities are flagged for us as critical for ckan/ckan-solr/2.10-solr9 & 2.11-solr9 images for the package golang/go:1.18.1

CVE-2023-24540
CVE-2023-24538
CVE-2023-29404
CVE-2023-29405
CVE-2023-29402
CVE-2024-24790

Please can you advise on possible remediation steps?

[miraldo]

Hi,

Any update, here? What strategy should we follow regarding this vulnerabilities?

[amercader]

We pull the upstream Solr images to build the custom CKAN ones.
The upstream Solr maintainers don't seem to think these vulnerabilities offer a vector given Solr usage: apache/solr#2542 (comment)

In any case when they release the new images with the upgraded Ubuntu version (apache/solr#3640) we will pull the latest upstream again and hopefully these warnings will go away.