Critical known CVE's found in latest release - v3.2.4

[TueDissingWork]

Kairos version:

PRETTY_NAME="Ubuntu 24.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04.1 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=noble
LOGO=ubuntu-logo

KAIROS_NAME="kairos-standard-ubuntu-24.04"
KAIROS_ID_LIKE="kairos-standard-ubuntu-24.04"
KAIROS_VERSION_ID="v3.2.4"
KAIROS_PRETTY_NAME="kairos-standard-ubuntu-24.04 v3.2.4"
KAIROS_IMAGE_REPO="quay.io/kairos/ubuntu:24.04-standard-amd64-generic-v3.2.4"
KAIROS_BUG_REPORT_URL="https://github.com/kairos-io/kairos/issues"
KAIROS_SOFTWARE_VERSION_PREFIX="k3s"
KAIROS_IMAGE_LABEL="24.04-standard-amd64-generic-v3.2.4"
KAIROS_ARTIFACT="kairos-ubuntu-24.04-standard-amd64-generic-v3.2.4"
KAIROS_FLAVOR="ubuntu"
KAIROS_MODEL="generic"
KAIROS_HOME_URL="https://github.com/kairos-io/kairos"
KAIROS_GITHUB_REPO="kairos-io/kairos"
KAIROS_VERSION="v3.2.4"
KAIROS_FLAVOR_RELEASE="24.04"
KAIROS_RELEASE="v3.2.4"
KAIROS_ID="kairos"
KAIROS_FAMILY="ubuntu"
KAIROS_VARIANT="standard"
KAIROS_TARGETARCH="amd64"
KAIROS_REGISTRY_AND_ORG="quay.io/kairos"

CPU architecture, OS, and Version:

Describe the bug

Scanning of latest v3.2.4 UKI docker image we found these critical and high CVE's:
go-git

• CVE-2025-21613
• CVE-2025-21614

Golang x/crypto/ssh

• CVE-2024-45337

Golang x/net

• CVE-2024-45338

Kernel related

• CVE-2024-53103

To Reproduce
Scan the kairos/ubuntu:24.04-standard-amd64-generic-v3.2.4-uki image with Trivy or XRay
Expected behavior

No critical CVE's and hopefully none high either

Logs

Additional context

[jimmykarily]

Those came out after our previous release was cut. We are preparing a new release soon: #2127 . Thanks for reporting these.

Also fyi: https://kairos.io/docs/reference/image_matrix/#versioning-policy

[TueDissingWork]

Those came out after our previous release was cut. We are preparing a new release soon: #2127 . Thanks for reporting these.

Also fyi: https://kairos.io/docs/reference/image_matrix/#versioning-policy

Yes I am aware that these a rather new CVE's - couldn't easily find a way to solve them myself, so reported then here instead.
However it seems that all of them have been addressed and should be relatively easy to mitigate -> update the affected dependencies.

Not sure how to control dependencies - happy to test various changes, but not sure how.