chore: update redis to avoid CVE-2022-2097

[crenshaw-dev]

The vulnerability showed up in a Snyk scan. https://argo-cd--9856.org.readthedocs.build/en/9856/snyk/master/redis%3A7.0.0-alpine.html

snyk container test redis:7.0.3-alpine shows the vulnerability as absent.

[crenshaw-dev]

Interesting question: do we cherry-pick this back to 2.2 and 2.3, even though it would bump Redis by a major version (6.2.6 to 7.0.3 - there's no fixed version on the 6.2.x series).

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 45.96%. Comparing base (708906d) to head (0446209).
Report is 2730 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #10031   +/-   ##
=======================================
  Coverage   45.96%   45.96%           
=======================================
  Files         227      227           
  Lines       27279    27279           
=======================================
  Hits        12538    12538           
  Misses      13039    13039           
  Partials     1702     1702           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[34fathombelow]

Interesting question: do we cherry-pick this back to 2.2 and 2.3, even though it would bump Redis by a major version (6.2.6 to 7.0.3 - there's no fixed version on the 6.2.x series).

I would stick to the policy of no major version changes between releases. I do see a new image of redis:6.2.7-alpine which has CVE-2022-2097 fixed. There is also a new redis:7.0.4-alpine image.

[crenshaw-dev]

@34fathombelow I'll put up separate PRs for 6.2.7 then. Thanks!

[crenshaw-dev]

@34fathombelow, Snyk is showing CVE-2022-2097 as still present in 6.2.7. :-(

$ snyk container test redis:6.2.7-alpine --org=argoproj

Testing redis:6.2.7-alpine...

✗ High severity vulnerability found in openssl/libcrypto1.1
  Description: Inadequate Encryption Strength
  Info: https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-2941806
  Introduced through: openssl/[email protected], openssl/[email protected], [email protected], apk-tools/[email protected], busybox/[email protected]
  From: openssl/[email protected]
  From: openssl/[email protected] > openssl/[email protected]
  From: [email protected] > openssl/[email protected]
  and 6 more...
  Image layer: 'apk add --no-network --virtual .redis-rundeps $runDeps'
  Fixed in: 1.1.1q-r0

✗ High severity vulnerability found in busybox/busybox
  Description: Use After Free
  Info: https://snyk.io/vuln/SNYK-ALPINE316-BUSYBOX-2953070
  Introduced through: busybox/[email protected], alpine-baselayout/[email protected], busybox/[email protected]
  From: busybox/[email protected]
  From: alpine-baselayout/[email protected] > alpine-baselayout/[email protected] > busybox/[email protected]
  From: busybox/[email protected]
  Image layer: Introduced by your base image (redis:6.2.7-alpine3.16)
  Fixed in: 1.35.0-r15



Organization:      argoproj
Package manager:   apk
Project name:      docker-image|redis
Docker image:      redis:6.2.7-alpine
Platform:          linux/amd64
Base image:        redis:6.2.7-alpine3.16
Licenses:          enabled

Tested 17 dependencies for known issues, found 2 issues.

Your base image is out of date
1) Pull the latest version of your base image by running 'docker pull redis:6.2.7-alpine3.16'
2) Rebuild your local image

Learn more: https://docs.snyk.io/products/snyk-container/getting-around-the-snyk-container-ui/base-image-detection

I might need to investigate and then add it to our ignore list, so it doesn't show up as a false positive on the Snyk report.

[crenshaw-dev]

Cherry-picked onto release-2.4 for 2.4.8.