AMAZON_LINUX_2 package updates on EKS AMI images

0

We just recently updated our EKS v1.24 instances to the latest baseline AMI image provided by Amazon: amazon/amazon-eks-node-1.24-v20231106 When looking at the Inspector results, it shows that there are two vulnerabilities with this image related to the Docker package (CVE-2023-39325 and CVE-2023-24540). Inspector says that there is a fix available for the package, and that we have to update the package from 0:20.10.23-1.amzn2.0.1.X86_64 up to 0:20.10.25-1.amzn2.0.3. However, when I log into the instance and try to use "Yum update docker" I am told that there are no new packages available. Even running a "yum --showduplicate list docker" shows that only version 20.10.23 is available in the available repo.

Why would the AWS Inspector screen tell me that I have to update the package, if a new package is not available in [amazon-lunix-extras] and I am unable to actually perform the update? This is ruining our security metrics, as it is showing as vulnerable but we are unable to update the AMI due to the new package version not being available.

Aucune réponse

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions