chaoscypher/dockerfile-minimal-terraform

This repository aims to create a useful, and minimal docker container that exposes the terraform binary to a host machine.

dockerfile-minimal-terraform's Issues

CVE detected in terraform go binary

Related to hashicorp/terraform#33158

The scratch image produced at the end of the CI workflow is being flagged by Trivy as the terraform binary has a CVE as seen below.

====================
Total: 1 (HIGH: 1, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                    Title                     │
├──────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2022-41723 │ HIGH     │ v0.6.0            │ 0.7.0         │ avoid quadratic complexity in HPACK decoding │
│                  │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-41723   │
└──────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────┘

It's also present in the sbom scan as seen below:

NAME                            INSTALLED                           FIXED-IN  TYPE       VULNERABILITY        SEVERITY 
github.com/hashicorp/terraform  v0.0.0-20230426175411-6c2c6cfa1b55            go-module  CVE-2018-9057        Critical  
github.com/hashicorp/terraform  v0.0.0-20230426175411-6c2c6cfa1b55            go-module  CVE-2019-19316       High      
github.com/hashicorp/terraform  v0.0.0-20230426175411-6c2c6cfa1b55            go-module  CVE-2021-36230       High      
golang.org/x/net                v0.6.0                              0.7.0     go-module  GHSA-vvpx-j8f3-3w6h  High

We'll have to wait for hashicorp to patch this go module.