Security Bulletin Changes #3120

karl-cardenas-coding · 2024-06-18T17:45:30Z

Describe the Change

This PR updates the security bulletin index page.

Changed Pages

💻 Preview URL for Page

Security Bulletins

Jira Tickets

🎫 DOC-1241

Backports

Can this PR be backported?

Yes. Remember to add the relevant backport labels to your PR.
No. Please leave a short comment below about why this PR cannot be backported.

netlify · 2024-06-18T17:45:48Z

✅ Deploy Preview for docs-spectrocloud ready!

Name	Link
🔨 Latest commit	`ebb13f0`
🔍 Latest deploy log	https://app.netlify.com/sites/docs-spectrocloud/deploys/669800ea853180000871baa4
😎 Deploy Preview	https://deploy-preview-3120--docs-spectrocloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

github-actions · 2024-07-17T16:30:00Z

docs/docs-content/security-bulletins/reports/reports.md

+
+| CVE ID                                          | Initial Pub Date | Modified Date | Impacted Product & Version | Vulnerability Type                      | CVSS Severity                                            | Status        |
+| ----------------------------------------------- | ---------------- | ------------- | -------------------------- | --------------------------------------- | -------------------------------------------------------- | ------------- |
+| [CVE-2023-52425](./cve-2023-52425.md)           | 02/04/2024       | 06/14/2024    | Palette 4.4.8              | Third-party component: vSphere-CSI      | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)   | :mag: Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '02/04/2024'.

github-actions · 2024-07-17T16:30:00Z

docs/docs-content/security-bulletins/reports/reports.md

+
+| CVE ID                                          | Initial Pub Date | Modified Date | Impacted Product & Version | Vulnerability Type                      | CVSS Severity                                            | Status        |
+| ----------------------------------------------- | ---------------- | ------------- | -------------------------- | --------------------------------------- | -------------------------------------------------------- | ------------- |
+| [CVE-2023-52425](./cve-2023-52425.md)           | 02/04/2024       | 06/14/2024    | Palette 4.4.8              | Third-party component: vSphere-CSI      | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)   | :mag: Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '06/14/2024'.

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libexpat'?

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'reparsings'?

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'vSphere' instead of 'vsphere'.

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae (cherry picked from commit 9bbd508)

vault-token-factory-spectrocloud · 2024-07-17T19:00:50Z

💔 Some backports could not be created

Status	Branch	Result
❌	version-4-0	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-0: - Create, style, and populate the Tutorials section (#2689)
❌	version-3-4	Backport failed because of merge conflicts You might need to backport the following PRs to version-3-4: - chore: DOC-1148 fix missing trailing slash (#2656) - Refactor/restructure cluster & app profiles sections (#1551) - docs: refactor for self-hosted Palette DOC-465 (#1597) - chore: released docs versioning
❌	version-4-1	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-1: - Create, style, and populate the Tutorials section (#2689)
❌	version-4-2	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-2: - chore: add vale rule (#2106)
❌	version-4-3	Backport failed because of merge conflicts
✅	version-4-4

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

backport --pr 3120

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae (cherry picked from commit 9bbd508) Co-authored-by: Karl Cardenas <29551334+karl-cardenas-coding@users.noreply.github.com>

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae

docs: DOC-1241

79ee128

karl-cardenas-coding changed the title ~~docs: DOC-1241~~ Security Bulletin Changes Jun 18, 2024

karl-cardenas-coding added 15 commits June 20, 2024 13:50

Merge branch 'master' into DOC-1241

f2f1796

docs: draft

5582ec5

chore: updated with link

0a3f37d

Merge branch 'master' into DOC-1241

78e839d

docs: updated disclosures

49f118f

docs: updated

8057afb

chore: updated

726634d

docs: updated

0898a21

docs: updates

55849a6

chore: updates

c79f20e

chore: fix

3fe4dcd

chore: missing URLs

16ead37

chore: updated prettier to exclude cve-page

fe3da33

chore: added N/A versus leaving blank

ff4f981

docs: updated CVEs

512aa55

karl-cardenas-coding marked this pull request as ready for review July 17, 2024 02:45

karl-cardenas-coding requested a review from a team as a code owner July 17, 2024 02:45

karl-cardenas-coding requested review from yuliiiah, addetz and caroldelwing July 17, 2024 02:45

github-actions bot reviewed Jul 17, 2024

View reviewed changes

docs: fix broken URL

6088e13

github-actions bot reviewed Jul 17, 2024

View reviewed changes

karl-cardenas-coding and others added 2 commits July 17, 2024 10:05

docs: updated intro langugae

9d6fca2

Merge branch 'master' into DOC-1241

ebb13f0

karl-cardenas-coding merged commit 9bbd508 into master Jul 17, 2024
15 checks passed

karl-cardenas-coding deleted the DOC-1241 branch July 17, 2024 18:59

vault-token-factory-spectrocloud bot mentioned this pull request Jul 17, 2024

[version-4-4] Security Bulletin Changes (#3120) #3398

Merged

This was referenced Jul 17, 2024

Update ghsa-m425-mq94-257g.md #3399

Merged

docs: add known issue #3400

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-2] Backport/version 4 2/pr 3120 #3407

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-1] backport/4-1/pr-3120 #3408

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-0]backport/version 4 0/pr-3120 #3409

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-3-4] Security Bulletin Changes (#3120) #3410

Merged

vault-token-factory-spectrocloud bot mentioned this pull request Jul 23, 2024

docs: VMO refactor #3040

Merged

1 task

vault-token-factory-spectrocloud bot mentioned this pull request Aug 19, 2024

chore: bump @typescript-eslint/eslint-plugin from 7.15.0 to 8.0.0 #3522

Merged

This was referenced Nov 22, 2024

User Management Refactor #4712

Merged

chore: security bulletin component #3639

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Bulletin Changes #3120

Security Bulletin Changes #3120

karl-cardenas-coding commented Jun 18, 2024 •

edited

Loading

netlify bot commented Jun 18, 2024 •

edited

Loading

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

vault-token-factory-spectrocloud bot commented Jul 17, 2024

Security Bulletin Changes #3120

Security Bulletin Changes #3120

Conversation

karl-cardenas-coding commented Jun 18, 2024 • edited Loading

Describe the Change

Changed Pages

Jira Tickets

Backports

netlify bot commented Jun 18, 2024 • edited Loading

✅ Deploy Preview for docs-spectrocloud ready!

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

vault-token-factory-spectrocloud bot commented Jul 17, 2024

💔 Some backports could not be created

Manual backport

Questions ?

karl-cardenas-coding commented Jun 18, 2024 •

edited

Loading

netlify bot commented Jun 18, 2024 •

edited

Loading