Address High vulnerabilities in ModelMesh SNYK reports

[heyselbi]

Address 14 high vulnerabilities in MM repos, upstream first. There are no critical vulnerabilities.

• 5 in modelmesh-runtime-adapter
• 3 in modelmesh-serving
• 1 in modelmesh
• 4 in odh-model-controller
• 1 in rest-proxy

(highly recommended but not required) Address quay.io vulnerabilities:

• 4 high in modelmesh-controller
• 1 critical in modelmesh
• 7 high in odh-model-controller

[spolti]

rest-proxy (community):

• depends on:
  • Upgrade sigs.k8s.io/controller-runtime to 0.15.x version kserve/modelmesh-serving#481
    • About this one, we have changed the apimachinery dependency on community, will apply the same on odh when we get it approved on comommunity.
  • chore: Upgrade Golang version from 1.18 to 1.19 kserve/rest-proxy#28
  • chore(deps): Upgrade golang.org/x/net and golang.org/grpc kserve/rest-proxy#30 - will address github.com/elazarl/goproxy Denial of Service (DoS).

rest-proxy (odh):

• github.com/elazarl/goproxy Denial of Service (DoS)
  -Fix github.com/elazarl/goproxy Denial of Service rest-proxy#24

[spolti]

Modelmesh updates:

• bump ubi8 tag
  • community: Bump ubi8 tag to 8.8 kserve/modelmesh#121
  • odh: Bump ubi8 tag to 8.8 modelmesh#45
• org.bouncycastle:bcprov-jdk15on:1.70
  • community: Address bounce castle cve alert kserve/modelmesh#122
  • odh: Address bounce castle cve alert modelmesh#46
• Zookeper
  • Depends on:
    • Update Zookeper IBM/litelinks-core#13
  • Needs to cherry-pick to odh: fix: Update zookeeper version to avoid CVE kserve/modelmesh#128
    • Sync: Sync modelmesh#47
      • this will also address the Quay report.
      • quay report is now green.
• Netty: There is no patch for https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-1042268, the suggested fix is to enable hostname verification by default (already done on netty 5).
  • I am in touch with Nick, litelinks maintainer to see what can we do.

[spolti]

odh-model-controller:

• github.com/openshift/api Authentication Bypass Using an Alternate Path or Channel

  • there is not fix for it, however there is a workaround:
  • Remove the permissions to update, patch the pods/ephemeralcontainers subresource from any low-privileged users, if there are any that currently hold it.
  • We are good since the odh-model-controller does not expose the given resource through rbac.

• github.com/elazarl/goproxy Denial of Service (DoS)

  • Address vulnerability on goproxy odh-model-controller#120

• Container Image:

  • https://quay.io/repository/opendatahub/odh-model-controller/manifest/sha256:af7a6ba1b3a81c105aa77af12afbc8e439704496ea74254c4b758a0de4d8e3a2?tab=vulnerabilities

• otelhttp fixes:

  • Fixes vulnerabilities on the otelhttp dependency odh-model-controller#123

[spolti]

Modelmesh-controller, alerts fixed:

• https://quay.io/repository/opendatahub/modelmesh-controller/manifest/sha256:53149f2b1c4f3b44c9584105cd576988100eb528c870f79cc4ccacf1a0c3bd4a?tab=vulnerabilities

[spolti]

modelmesh-serving:

• odh: vulnerabilities fixes #254
• community: chore(deps): Upgrade opentelemetry/http and k8s.io/apimachinery kserve/modelmesh-serving#459

[spolti]

modelmesh-runtime-adapter:

• odh: vulnerability fixes modelmesh-runtime-adapter#37
• community: WIP

Migrated to #256
As it depends on kserve/modelmesh-runtime-adapter#68