fix: Upgraded docker distribution go package to v2.8.2 for fixing a high vulnerability

[Jonsy13]

Motivation

Here from LitmusChaos Again!!

After our last PR - #11538 got merged, we scanned the latest images again, we found one more vulnerability in both workflow-controller and argoexec which may have been missed earlier -

Scan results for: image [quay.io/argoproj/argoexec:latest] sha256:ee7f51a0169c160f6c04e4a85d3fddae14b5ff640d0b2202a8e8fb7ffc4ddef4
Vulnerabilities
+---------------+----------+------+--------------------------------+---------+-----------------------+-----------+------------+----------------------------------------------------+
|      CVE      | SEVERITY | CVSS |            PACKAGE             | VERSION |        STATUS         | PUBLISHED | DISCOVERED |                    DESCRIPTION                     |
+---------------+----------+------+--------------------------------+---------+-----------------------+-----------+------------+----------------------------------------------------+
| CVE-2023-2253 | high     | 7.00 | [github.com/docker/distribution] | v2.8.1  | fixed in 2.8.2-beta.1 | 64 days   | < 1 hour   | A flaw was found in the `/v2/_catalog` endpoint    |
|               |          |      |                                |         | 90 days ago           |           |            | in distribution/distribution, which accepts a      |
|               |          |      |                                |         |                       |           |            | parameter to control the maximum number of records |
|               |          |      |                                |         |                       |           |            | retur...                                           |
+---------------+----------+------+--------------------------------+---------+-----------------------+-----------+------------+----------------------------------------------------+

Vulnerabilities found for image [quay.io/argoproj/argoexec:latest]: total - 1, critical - 0, high - 1, medium - 0, low - 0

and also there was one compliance issue (only in argoexec but not in workflow-controller), on checking Dockerfile, we found that argoexec container doesn't have a USER set like other containers (workflow-controller, UI,etc) -

Compliance Issues
+----------+------------------------------------------------------------------------------+
| SEVERITY |                                 DESCRIPTION                                  |
+----------+------------------------------------------------------------------------------+
| high     | (CIS_Docker_v1.5.0 - 4.1) Image should be created with a non-root user       |

Modifications

Have updated the docker distribution go package to 2.8.2 & also added USER instruction USER 8737 in argoexec build stage just like workflow-controller.

NOTE - Do let us know if USER instruction is not required, will remove it again! Thanks!!

Verification

[gdsoumya]

LGTM

[terrytangyuan]

Thanks. I'll include this in #11552

[terrytangyuan]

Could you do a scan of v3.4.9 and see if there are any important fixes that should go in v3.4.10 #11552?

[Jonsy13]

Sure @terrytangyuan Will do!! Thanks!

[terrytangyuan]

Need some eyes on this

[Jonsy13]

Sure, let me know if you think this will take time, I can remove this change from this PR & have it in a separate one. Don't want to make it release blocker for you! 😄

[terrytangyuan]

Let's remove it for now

[Jonsy13]

Done thanks!!

[Jonsy13]

Scanned v3.4.9, There was only one more -

| PRISMA-2023-0056 | medium   | 6.20 | [github.com/sirupsen/logrus]       | v1.9.2  | fixed in v1.9.3          | > 4 months | < 1 hour   | The [github.com/sirupsen/logrus] module of all       |
|                  |          |      |                                   |         | > 5 months ago           |            |            | versions is vulnerable to denial of service.       |
|                  |          |      |                                   |         |                          |            |            | Logging more than 64kb of data in a single entry   |
|                  |          |      |                                   |         |                          |            |            | without new...

But this is already fixed in latest tag, master branch & release-3.5 branch as well -

argo-workflows/go.mod

Line 46 in cb1713d

github.com/sirupsen/logrus v1.9.3

.