Fix CVE-2021-32740

[danielhoherd]

Fix CVE-2021-32740 in fluentd

[vishwas-astro]

@danielhoherd Do we need to update the version with this?

[danielhoherd]

@vishwas-astro good catch!

[danielhoherd]

Unfortunately the addressable package is also installed by a dependency and it installs an outdated version.

var/lib/gems/2.7.0/gems/fluent-plugin-kubernetes_metadata_filter-2.7.1/Gemfile.lock (bundler)
=============================================================================================
Total: 1 (HIGH: 1, CRITICAL: 0)

+-------------+------------------+----------+-------------------+---------------+---------------------------------------+
|   LIBRARY   | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION |                 TITLE                 |
+-------------+------------------+----------+-------------------+---------------+---------------------------------------+
| addressable | CVE-2021-32740   | HIGH     | 2.7.0             | 2.8.0         | rubygem-addressable:                  |
|             |                  |          |                   |               | ReDoS in templates                    |
|             |                  |          |                   |               | -->avd.aquasec.com/nvd/cve-2021-32740 |
+-------------+------------------+----------+-------------------+---------------+---------------------------------------+

[danielhoherd]

I've opened an issue and a pr upstream.

[danielhoherd]

@vishwas-astro @andriisoldatenko @pgvishnuram The last vulnerable package was fixed upstream via fabric8io/fluent-plugin-kubernetes_metadata_filter#300