Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

security: bump envoy version and k8s.io/apimachinery #21017

Merged
merged 10 commits into from
May 2, 2024
Merged

security: bump envoy version and k8s.io/apimachinery #21017

merged 10 commits into from
May 2, 2024

Conversation

dduzgun-security
Copy link
Collaborator

@dduzgun-security dduzgun-security commented Apr 25, 2024 •
edited
Loading

Description

Upgrade to support Envoy 1.27.5, and 1.28.3.
This resolves CVE-2024-32475 (auto_sni).

Upgrade to support k8s.io/apimachinery to to v0.18.7 or higher.
This resolves CVE-2020-8559.

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@dduzgun-security dduzgun-security requested a review from a team as a code owner April 25, 2024 19:41
@github-actions github-actions bot added type/docs Documentation needs to be created/updated/clarified type/ci Relating to continuous integration (CI) tooling for testing or releases theme/contributing Additions and enhancements to community contributing materials labels Apr 25, 2024
zalimeni
zalimeni approved these changes Apr 30, 2024
View reviewed changes
Copy link
Member

@zalimeni zalimeni left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@dduzgun-security dduzgun-security requested a review from a team as a code owner May 1, 2024 21:53
@dduzgun-security dduzgun-security changed the title security: bump envoy version and triage GHSA-33c5-9fx5-fvjm security: bump envoy version and k8s.io/apimachinery May 1, 2024
@zalimeni zalimeni merged commit 3a6f2fb into main May 2, 2024
85 of 86 checks passed
@zalimeni zalimeni deleted the security/net-7785/envoy-apimachinery branch May 2, 2024 17:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zalimeni zalimeni zalimeni approved these changes

Assignees
No one assigned
Labels
pr/no-backport theme/contributing Additions and enhancements to community contributing materials type/ci Relating to continuous integration (CI) tooling for testing or releases type/docs Documentation needs to be created/updated/clarified
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dduzgun-security @zalimeni