Update module github.com/crossplane/crossplane to v1.11.5 [SECURITY] - autoclosed #119
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.10.0
->v1.11.5
GitHub Vulnerability Alerts
CVE-2023-27484
Summary
Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a vulnerability in the
fieldpath
package fromcrossplane/crossplane-runtime
that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplane.Details
Compositions allow users to specify patches inserting elements into arrays at an arbitrary index. When a Composition is selected for a Composite Resource, patches are evaluated and if a specified index is greater than the current size of the target slice, that slice's size will be increased to the specified index, which could lead to an excessive amount of memory usage and therefore the Pod being OOM-Killed. The index is already capped to the maximum value for a uint32 (4294967295) when parsed, but that is still an unnecessarily large value.
Workaround
Users can restrict write privileges on Compositions to only admin users as a workaround.
CVE-2023-38495
Impact
Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package.
Patches
The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of writing.
Workarounds
Only using images from trusted sources and keeping Package editing/creating privileges to administrators only, which should be both considered already best practices.
References
See
ADA-XP-23-11
in the Security Audit's report.Credits
This was reported as
ADA-XP-23-11
by @AdamKorcz and @DavidKorczynski from Ada Logic and facilitated by OSTIF as part of the Security Audit sponsored by CNCF.CVE-2023-37900
Impact
An high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled.
The impact is low due to the high privileges required to be able to create the Package and the eventually consistency nature of controller.
Patches
The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of writing.
Workarounds
Only using images from trusted sources and keeping Package editing/creating privileges to administrators only, which should be both considered already best practices.
References
See
ADA-XP-23-16
in the Security Audit's report.Credits
This was reported as
ADA-XP-23-16
by @AdamKorcz and @DavidKorczynski from Ada Logic and facilitated by OSTIF as part of the Security Audit sponsored by CNCF.Release Notes
crossplane/crossplane (github.com/crossplane/crossplane)
v1.11.5
Compare Source
v1.11.5
addresses a few security issues shared during the security audit by Ada Logic and facilitated by OSTIF, sponsored by CNCF. See the report for more details.Notable changes
What's Changed
d8f9d38
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/41959bd077d
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/4335Full Changelog: crossplane/crossplane@v1.11.4...v1.11.5
v1.11.4
Compare Source
v1.11.4
addresses a few minor bugs and bumps a few dependencies to address vulnerabilities image scanners might have reported.Notable changes
HIGH
CVEs reported by image scanners.What's Changed
a01d47d
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/39627198a35
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/4059e1a80fd
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3861Full Changelog: crossplane/crossplane@v1.11.3...v1.11.4
v1.11.3
Compare Source
v1.11.3
is a scoped patch release that focuses on an issue that was preventing the alpha feature of Composition Functions from successfully running in certain environments that have a version ofcrun
of 1.8+ (issue #3807). This release should unblock the general testing and feedback on Composition Functions again. Thank you @AndrewChubatiuk for contributing this fix!What's Changed
97b762e
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3913Full Changelog: crossplane/crossplane@v1.11.2...v1.11.3
v1.11.2
Compare Source
v1.11.2
bumps thecrossplane-runtime
version, in order to address a Crossplane vulnerability, caused by GHSA-vfvj-3m3g-m532.These vulnerabilities were discovered thanks to the fuzz tests added to the Crossplane project by Ada Logics as part of a security audit sponsored by the CNCF.
What's Changed
3c57678
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3811Full Changelog: crossplane/crossplane@v1.11.1...v1.11.2
v1.11.1
Compare Source
v1.11.1
contains a fix forComposition Functions
causing extra resources to be created (#3774), applies the--pollInterval
CLI argument to theClaim
andComposite
reconcilers (#3773), and adds the CompositeKind
andAPIVersion
information to thekubectl get
output columns forCompositions
andCompositionRevisions
. Additional dependency and CI updates are also included.What's Changed
450981e
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3700ffd3e96
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3727d2e0993
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3738199482f
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/372972cc75f
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3768d02be0e
(release-1.11) by @renovate in https://github.com/crossplane/crossplane/pull/3769Full Changelog: crossplane/crossplane@v1.11.0...v1.11.1
v1.11.0
Compare Source
Release v1.11.0 is a regularly scheduled quarterly release that includes many exciting features that have been highly requested by the Crossplane community, such as Composition Functions, EnvironmentConfig, and promoting CompositionRevisions to beta.
Additionally, this v1.11.0 release includes a major documentation rewrite based on direct feedback from Crossplane users, and also focuses on stability fixes and design investigations.
New Features
Notable Updates
What's Changed
GOMAXPROCS
andGOMEMLIMIT
based on resource limits by @epk in https://github.com/crossplane/crossplane/pull/3432production
by @mplzik in https://github.com/crossplane/crossplane/pull/3434revive
andnolintlint
linters. by @negz in https://github.com/crossplane/crossplane/pull/3462CompositionRevision
to v1beta1 by @ezgidemirel in https://github.com/crossplane/crossplane/pull/3453goverter
to automatically generate conversion code by @negz in https://github.com/crossplane/crossplane/pull/347911364b4
(master) by @renovate in https://github.com/crossplane/crossplane/pull/3610c79ef2d
(master) by @renovate in https://github.com/crossplane/crossplane/pull/3643700fd90
(master) by @renovate in https://github.com/crossplane/crossplane/pull/36495bda5a4
(master) by @renovate in https://github.com/crossplane/crossplane/pull/36529ab158e
(master) by @renovate in https://github.com/crossplane/crossplane/pull/36723ebbd71
(master) by @renovate in https://github.com/crossplane/crossplane/pull/3673New Contributors
Full Changelog: crossplane/crossplane@v1.10.0...v1.11.0
v1.10.4
Compare Source
v1.10.4
bumps a few dependencies to address vulnerabilities image scanners might have reported.Notable changes
HIGH
CVEs reported by image scanners.What's Changed
f1e013b
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/386097b762e
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/3863a01d47d
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/39617198a35
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/4057Full Changelog: crossplane/crossplane@v1.10.3...v1.10.4
v1.10.3
Compare Source
v1.10.3
bumps thecrossplane-runtime
version, in order to address a Crossplane vulnerability, caused by GHSA-vfvj-3m3g-m532.These vulnerabilities were discovered thanks to the fuzz tests added to the Crossplane project by Ada Logics as part of a security audit sponsored by the CNCF.
What's Changed
450981e
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/3699d2e0993
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/3734d02be0e
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/37673c57678
(release-1.10) by @renovate in https://github.com/crossplane/crossplane/pull/3810Full Changelog: crossplane/crossplane@v1.10.2...v1.10.3
v1.10.2
Compare Source
The
v1.10.2
release includes fixes for restoring the documentedpackagePullPolicy: Always
behavior (https://github.com/crossplane/crossplane/pull/3581) as well as a follow-up fix to https://github.com/crossplane/crossplane/pull/3426 for constantly enqueued reconciles forProviderRevisions
marked asInactive
(https://github.com/crossplane/crossplane/pull/3582). There were also numerous documentation fixes and minor dependency updates.What's Changed
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.