Vulnerabilities in SumoLogic collector

[ddartiaga]

Hello,

We have created a Windows container and we installed the SumoLogic collector v0.108.0-1649 inside.
During the container scan using Trivy, it shows it has vulnerabilities. How can I mitigate the findings?

https://avd.aquasec.com/nvd/cve-2024-0406
https://avd.aquasec.com/nvd/cve-2024-34156
https://avd.aquasec.com/nvd/cve-2024-34155
https://avd.aquasec.com/nvd/cve-2024-34158

Steps to reproduce

1. Build a Windows container from mcr.microsoft.com/windows/servercore:ltsc2019
2. Install the SumoLogic using the script (provide the token) https://raw.githubusercontent.com/SumoLogic/sumologic-otel-collector/main/scripts/install.ps1
3. Install Trivy CLI and Scan the container image - https://aquasecurity.github.io/trivy/v0.33/docs/vulnerability/scanning/image/

[echlebek]

This is not the correct repository for this issue, please file to https://github.com/SumoLogic/sumologic-otel-collector in the future.

[echlebek]

Thank you for the issue report. The software does indeed import mholt/archiver, it is used in the "jobreceiver" module.

We'll be upgrading or replacing this dependency to resolve this issue. In the mean time, you can simply avoid the jobreceiver module in your open-telemetry configuration to mitigate any risk associated with this CVE.