Vulnerabilities found in skaffold v2.10.1 binary (2 critical)

[elizabethbarkett]

Version affected: v2.10.1
While working on reducing vulnerabilities in our internal tooling, we noticed that the skaffold binary has 2 critical vulnerabilities that stem from moby/buildkit.

Steps:
Vulnerabilities were found by running:

govulncheck -mode=binary -show verbose /home/linuxbrew/.linuxbrew/bin/skaffold

go 1.21.6 should also be updated to >=1.21.8 to resolve multiple stdlib vulnerabilities

Dependencies affected:
github.com/moby/buildkit

• CVE-2024-23653 (critical)
• CVE-2024-23652 (critical)
• CVE-2024-23650 (unknown)
• CVE-2024-23651(unknown)
• all patched in 0.12.5

github.com/containerd/containerd

• GHSA-7ww5-4wqc-m92c (moderate)
• patched in v1.7.11

github.com/sigstore/cosign/v2

• CVE-2023-46737 (unknown)
• patched in v2.2.1

github.com/cloudflare/circl

• GHSA-9763-4f94-gfch (High)
• patched in v1.3.7

google.golang.org/protobuf

• CVE-2024-24786
• patched in 1.33.0 (unaffected)

[elizabethbarkett]

This MR exists for updating moby/buildkit; looks like it will take a little work to get tests passing

[elizabethbarkett]

The cloudflare/circl MR looks good to go on approval which will resolve the high vulnerability listed above.

[elizabethbarkett]

moby/buildkit updated in main, closing issue