Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Request for incremental release of 0.10.x to address GO Security Vulnerabilities #830

Closed
jhawkins1 opened this issue Dec 31, 2022 · 1 comment
Closed

Request for incremental release of 0.10.x to address GO Security Vulnerabilities #830

jhawkins1 opened this issue Dec 31, 2022 · 1 comment
Labels
area/misc Impacts miscellaneous areas of the code not otherwise owned by another area. 📊 kind/community-report This was reported by a user in the Cilium/Hubble community, eg via Slack.

Comments

@jhawkins1
Copy link

Current Hubble 0.10.0 contains 16 GO related CVEs. Updating Hubble to use 1.18.9 will address these CVEs that have occurred since the June 2022 release of 0.10.0. I am requesting an incremental release of 0.10.x with this issue submission. Has there been any thought to aligning Hubble incremental release cadence with that of Cilium cadence (1.12.5 came out last week and updated to 1.18.9 GO) ?
@kaworu kaworu added area/misc Impacts miscellaneous areas of the code not otherwise owned by another area. 📊 kind/community-report This was reported by a user in the Cilium/Hubble community, eg via Slack. labels Jan 3, 2023
@kaworu kaworu mentioned this issue Jan 3, 2023
Merged
@gandro
Copy link
Member

gandro commented Jan 11, 2023

Hubble v0.11 with updated dependencies has been released.

For future reference, please share the exact CVEs are are concerned with. Not every Golang CVE affects every Go program, as far as I am aware, Hubble v0.10 is not vulnerable to any recent high-risk Golang CVE.

@gandro gandro closed this as completed Jan 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/misc Impacts miscellaneous areas of the code not otherwise owned by another area. 📊 kind/community-report This was reported by a user in the Cilium/Hubble community, eg via Slack.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gandro @kaworu @jhawkins1