[release-24.6] bump cuda base images to fix CVE 2024-6345 #1004
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tariq1890
requested review from
ArangoGutierrez,
cdesiniotis,
elezar and
shivamerla
as code owners
|
Attached screenshot to show the High CVEs
|
|
@tariq1890 golangci-lint is failing |
|
@cdesiniotis Fixed by #1005 |
Signed-off-by: Tariq Ibrahim <tibrahim@nvidia.com>
tariq1890
force-pushed
the
bump-cuda-base-cve
branch
from
635dba1
to
b84a079
Compare
cdesiniotis
approved these changes
Sep 20, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The gpu-operator v24.6.1 tag currently has two HIGH CVEs appearing on its security scans. These CVEs are inherited through the use of the
cuda:12.5.1-base-ubi8base image. This CVE has since been fixed in the latest cuda base image12.6.1-base-ubi8Limiting this changeset to the release-24.6 branch as we are using ubi9 base images in the
mainbranch