skupper-service-controller:1.6.02.3.0 contains CVE-2020-10735

[michaelscrawford]

CVE-2024-3596 is reported for the following images:

• config-sync:1.6.0 - https://quay.io/repository/skupper/config-sync/manifest/sha256:ac7138c155cd5521b4f167e30d5ef2e3c93a3d163fd95c546c8d68979048f13b?tab=vulnerabilities&fixable=true
• service-controller:1.6.0 - https://quay.io/repository/skupper/service-controller/manifest/sha256:b8d9fe1bf024738df033a33fba514b8368093f8a4377e3fb4cbce5515e9baff8?tab=vulnerabilities&fixable=true
• site-controller:1.6.0 - https://quay.io/repository/skupper/site-controller/manifest/sha256:e350d3189c14c560765c8f657becd12b7f1698c9f331f5c7ea6f53137f206c1c?tab=vulnerabilities&fixable=true

A vulnerability in the RADIUS (Remote Authentication Dial-In User Service) protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof UDP-based RADIUS response packets. This can result in unauthorized access by modifying an Access-Reject response to an Access-Accept response, thereby compromising the authentication process.

I believe this can be resolved by upgrading the ubi9 image to 9.5-*.

Is it possible to spin new versions of these 3 images with the updated ubi version? E.g. 1.6.1?