AMAZON_LINUX_2 package updates on EKS AMI images

0

We just recently updated our EKS v1.24 instances to the latest baseline AMI image provided by Amazon: amazon/amazon-eks-node-1.24-v20231106 When looking at the Inspector results, it shows that there are two vulnerabilities with this image related to the Docker package (CVE-2023-39325 and CVE-2023-24540). Inspector says that there is a fix available for the package, and that we have to update the package from 0:20.10.23-1.amzn2.0.1.X86_64 up to 0:20.10.25-1.amzn2.0.3. However, when I log into the instance and try to use "Yum update docker" I am told that there are no new packages available. Even running a "yum --showduplicate list docker" shows that only version 20.10.23 is available in the available repo.

Why would the AWS Inspector screen tell me that I have to update the package, if a new package is not available in [amazon-lunix-extras] and I am unable to actually perform the update? This is ruining our security metrics, as it is showing as vulnerable but we are unable to update the AMI due to the new package version not being available.

No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions