AMAZON_LINUX_2 package updates on EKS AMI images

0

We just recently updated our EKS v1.24 instances to the latest baseline AMI image provided by Amazon: amazon/amazon-eks-node-1.24-v20231106 When looking at the Inspector results, it shows that there are two vulnerabilities with this image related to the Docker package (CVE-2023-39325 and CVE-2023-24540). Inspector says that there is a fix available for the package, and that we have to update the package from 0:20.10.23-1.amzn2.0.1.X86_64 up to 0:20.10.25-1.amzn2.0.3. However, when I log into the instance and try to use "Yum update docker" I am told that there are no new packages available. Even running a "yum --showduplicate list docker" shows that only version 20.10.23 is available in the available repo.

Why would the AWS Inspector screen tell me that I have to update the package, if a new package is not available in [amazon-lunix-extras] and I am unable to actually perform the update? This is ruining our security metrics, as it is showing as vulnerable but we are unable to update the AMI due to the new package version not being available.

已提問 6 個月前檢視次數 99 次
沒有答案

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南