Addressing a lot of security vulnerabilities in the latest Cadence release

[sonpham96]

Version of Cadence server, and client(which language)
This is very important to root cause bugs.

• Server version: v0.24.0
• Client version:
• Client langauge:

Describe the bug
A clear and concise description of what the bug is.

There are a lot of CVEs found by scanning the latest release image v0.24.0. Most of these CVEs are resolved in the image built from master. Following is the list of CVEs:

CVEs that may be fixed by [#5035] (pending review):

• go
  • high
    • CVE-2022-2880
    • CVE-2022-2879
    • CVE-2022-41715
    • CVE-2022-27664
  • medium
    • CVE-2022-41716

CVEs that have already been fixed by [#4957], but have not been released:

• go
  • critical
    • CVE-2022-23806
  • high
    • CVE-2022-32189
    • CVE-2022-30635
    • CVE-2022-30633
    • CVE-2022-30632
    • CVE-2022-30631
    • CVE-2022-30630
    • CVE-2022-30580
    • CVE-2022-28327
    • CVE-2022-28131
    • CVE-2022-24921
    • CVE-2022-24675
    • CVE-2022-23773
    • CVE-2022-23772
    • CVE-2021-44716
  • medium
    • CVE-2022-32148
    • CVE-2022-1962
    • CVE-2022-1705
  • low
    • CVE-2022-30629

CVEs that have already been fixed by [#4804], but have yet made it to v0.24.0:

• curl

  • critical
    • CVE-2022-32207
  • high
    • CVE-2022-27782
    • CVE-2022-27781
    • CVE-2022-27775
    • CVE-2022-22576
  • medium
    • CVE-2022-32208
    • CVE-2022-32206
    • CVE-2022-32205
    • CVE-2022-27776
    • CVE-2022-27774

• zlib

  • critical
    • CVE-2022-37434
    • CVE-2018-25032

• openssl

  • critical
    • CVE-2022-2068
    • CVE-2022-1292
  • high
    • CVE-2022-0778
  • medium
    • CVE-2022-2097
    • CVE-2021-4160

• busybox

  • high
    • CVE-2022-28391

• ncurses

  • high
    • CVE-2022-29458
    • CVE-2021-39537

Not fixed:

• curl
  • critical
    • CVE-2022-42915
  • high
    • CVE-2022-42916
  • low
    • CVE-2022-35252
    • CVE-2022-32221

Would it be possible for another release of Cadence to make it in a few weeks left of this year? The latest one has been released for more than half year already.

To Reproduce
Is the issue reproducible?

• Yes, with any security vulnerability scanner on the Cadence server image.

Steps to reproduce the behavior:
A clear and concise description of the reproduce steps.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here, E.g. Stackstace, workflow history.

I have made a similar request back in August: #4803 (comment).

[thle40]

Echo on this topic and I would like to add more Critical CVEs found with later twistlock version which put our system into high risk state
curl
CVE-2022-43551
bash
CVE-2022-3715
go
CVE-2022-30629
CVE-2022-41717
busybox
CVE-2021-42376

[thle40]

With new version of twistlock, more critical CVEs found which impact to security of our system
go

• CVE-2022-27191
• CVE-2022-21698
• CVE-2021-43565
• PRISMA-2022-0164
• CVE-2021-31525

OS

• CVE-2023-0215
• CVE-2022-43552

[ibarrajo]

Closing this since we are giving support to more recent releases, currently the latest one is v1.2.13.