Any chance of a clair release with claircore >= v1.5.54? (OSV CVSS panic, #2499)

[Dennis Andersen]

Hi all,

I've been following #2499, where hdonnay confirmed the fix went into claircore (commit 92e393f).
I wasn't on that thread so I'm starting a fresh one, but it's the same issue, just coming at it from the packaging side.

We're running clair 4.9.0 from the published container image and getting bitten by the same panic.

The fix itself is small and looks solid (it guards the CVSS parse error before scoring, in the osv updater code),

and from the commit it first lands in a claircore release at v1.5.54. The snag for us is that there's no clair release 

yet bundling v1.5.54, and since claircore is compiled into the clair binary we can't just bump it in our deployment.

So everyone on thec ontainer images is still on v1.5.48 and the crash.

So really my question is just: is a clair release with claircore >= v1.5.54 on the horizon? That's the one thing that unblocks image users.

For what it's worth on priority, it's spread well beyond openEuler for us. As more OSV ecosystems pick up 

CVSS v4 we've seen it hit tuxcare, alpaquita and bitnami too, and because the panic takes down the whole process, 

clair just crash-loops and stops scanning entirely. The only stopgaps are disabling the OSV updater (which drops language-deps coverage)
or building a custom clair image, neither ideal for a bug that's already fixed upstream. 

Thanks for all the work on clair!

Sincerely
Dennis Andersen, Fortnox AB 

Innehållet i detta e-postmeddelande är konfidentiellt och avsett endast för adressaten.

Varje spridning, kopiering eller utnyttjande av innehållet är förbjuden utan tillåtelse av avsändaren. Om detta meddelande av misstag gått till fel adressat vänligen radera det ursprungliga meddelandet och underrätta avsändaren via e-post