efk addon image contains Log4j CVEs

[spowelljr]

The efk addon contains the image k8s.gcr.io/elasticsearch:v5.6.2@sha256:7e95b32a7a2aad0c0db5c881e4a1ce8b7e53236144ae9d9cfb5fbe5608af4ab2

This image contains Log4j CVEs

  ✗ Remote Code Execution (RCE) [Critical Severity][https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720] in org.apache.logging.log4j:log4j-core@2.9.1
    introduced by org.apache.logging.log4j:log4j-core@2.9.1
  ✗ Remote Code Execution (RCE) [Critical Severity][https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2320014] in org.apache.logging.log4j:log4j-core@2.9.1
    introduced by org.apache.logging.log4j:log4j-core@2.9.1

If you are using the addon we recommend you run minikube addons disable efk to terminate the vulnerable pod.
If you are not using the efk addon you are not vulnerable.

• Prevent users from enabling the addon (Prevent enabling efk addon due to containing Log4j CVE #15281)
• Look into updating the images
• Allow re-enabling the addon

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[henk52]

I assume this is complicated to resolve, are there anywhere to go read up on how to solve this issue?

[spowelljr]

It requires replacing the vulnerable elasticsearch image with an updated one and making sure the addon still works as intended. After that's completed we can unban the addon.

[nekperu15739]

Hi,
I know its a risk, however for local dev, Is there any work around, in favor of made possible enable the addon?

[nekperu15739]

Hi @spowelljr

Any update on this?

[Sikamator]

Any updates?

[spowelljr]

I created a PR to update the elasticsearch, kibana, and alpine images. I have no idea if the addon will continue to work with the updated images. You can test the PR once it's finished building and let me know if it's working as expected.

[spowelljr]

The pods are coming up which is promising

$ kubectl get pods -A
NAMESPACE     NAME                               READY   STATUS    RESTARTS        AGE
kube-system   coredns-787d4945fb-rfbgc           1/1     Running   0               2m45s
kube-system   elasticsearch-logging-hnpz6        1/1     Running   0               118s
kube-system   etcd-minikube                      1/1     Running   0               2m58s
kube-system   fluentd-es-xxsjv                   1/1     Running   0               118s
kube-system   kibana-logging-vl7s9               1/1     Running   0               118s
kube-system   kube-apiserver-minikube            1/1     Running   0               3m
kube-system   kube-controller-manager-minikube   1/1     Running   0               2m58s
kube-system   kube-proxy-zvmp9                   1/1     Running   0               2m45s
kube-system   kube-scheduler-minikube            1/1     Running   0               2m58s
kube-system   storage-provisioner                1/1     Running   1 (2m14s ago)   2m57s

[spowelljr]

Here's the macOS amd64 binary: https://storage.googleapis.com/minikube-builds/16343/minikube-darwin-amd64
Linux amd64 binary: https://storage.googleapis.com/minikube-builds/16343/minikube-linux-amd64

If someone could test it and let me know if it works as expected. If someone needs a different binary just let me know

[Sikamator]

Here's the macOS amd64 binary: https://storage.googleapis.com/minikube-builds/16343/minikube-darwin-amd64 Linux amd64 binary: https://storage.googleapis.com/minikube-builds/16343/minikube-linux-amd64

If someone could test it and let me know if it works as expected. If someone needs a different binary just let me know

Hello,
I've tested it. And confirm it's works fine. Thank You.

[spowelljr]

Hi @Sikamator, just confirming that the addon is working as expected as well? ie. It's aggregating logs as expected, not just that the addon started

[gryphon2411]

@spowelljr, your PR review failed, and as a result, wasn't merged

[wdcs-meetsoni]

still can't enable any updates ?