Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[NET-8946 NET-8947 NET-8948] security: bump go, x/net and envoy versions #20956

Merged
merged 12 commits into from
Apr 8, 2024
Merged

[NET-8946 NET-8947 NET-8948] security: bump go, x/net and envoy versions #20956

merged 12 commits into from
Apr 8, 2024

Conversation

dduzgun-security
Copy link
Contributor

@dduzgun-security dduzgun-security commented Apr 5, 2024 •
edited

Description

Upgrade to use Go 1.21.9. This resolves CVEs
CVE-2023-45288 (http2).

Upgrade to support Envoy 1.26.8, 1.27.4 and 1.28.2. This resolves CVEs
CVE-2024-27919 (http2).

Upgrade to use golang.org/x/net v0.24.0. This resolves CVEs
CVE-2023-45288 (x/net).

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@dduzgun-security dduzgun-security added backport-inactive/1.15 This release series is longer active. Use backport/ent/1.15. backport-inactive/1.16 This release series is no longer active backport-inactive/1.17 This release series is no longer active. Use backport/ent/1.17. backport/1.18 labels Apr 5, 2024
@github-actions github-actions bot added type/docs Documentation needs to be created/updated/clarified theme/api Relating to the HTTP API interface type/ci Relating to continuous integration (CI) tooling for testing or releases pr/dependencies PR specifically updates dependencies of project theme/contributing Additions and enhancements to community contributing materials labels Apr 5, 2024
@dduzgun-security dduzgun-security marked this pull request as ready for review April 5, 2024 18:42
@dduzgun-security dduzgun-security requested review from a team as code owners April 5, 2024 18:42
zalimeni
zalimeni reviewed Apr 5, 2024
View reviewed changes
Copy link
Member

@zalimeni zalimeni left a comment •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM except for the Envoy 1.29 upgrade - which we should do before 1.19 RC, but doesn't need to be part of this fix IMO.

The cherry pick for the x/net may succeed, but will likely fail, at least on 1.15. Fixup should be as simple as running make go-mod-get again as you did here after resolving conflicts (you can just accept changes from the target branch, bc everything will be updated again for you).

The Envoy changes will need manual fixing in backports since the versions are distinct across branches.

Thank you for tackling this @dduzgun-security !

cc @david-yu

.changelog/20956.txt Outdated Show resolved Hide resolved
.changelog/20956.txt Outdated Show resolved Hide resolved
.changelog/20956.txt Outdated Show resolved Hide resolved
.github/workflows/nightly-test-integrations.yml Outdated Show resolved Hide resolved
dduzgun-security and others added 2 commits April 5, 2024 16:28
@dduzgun-security @zalimeni
Apply suggestions from code review
d18ca5b 
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
@dduzgun-security
Removing envoy v1.29.X for now
dbcfcee
zalimeni
zalimeni approved these changes Apr 8, 2024
View reviewed changes
Copy link
Member

@zalimeni zalimeni left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small fix to the changelog, otherwise LGTM - thank you @dduzgun-security !

And just to clarify (fixed my message above): the backports for Envoy will need manual fixing no matter what, bc the version ranges are different per release line. Since the backport label is more of a formality here, you could also consider removing it to avoid the failed automated backports entirely. If you use labels, Backport Checker will notify you of missing backports until you merge them, and they'll require a special "Overview of commits" section in the PR description (added by BPA to automated backport PRs) to satisfy the check. If you decide to use backport labels and get failed backport PRs, you can copy that section to the new manual PR.

This PR is an example of a manual one-off PR to "backport" an upgrade to a release branch (the original did not have backport labels): #18303

.changelog/20956.txt Outdated Show resolved Hide resolved
@dduzgun-security @zalimeni
Update .changelog/20956.txt
55697a1 
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
@dduzgun-security dduzgun-security removed backport-inactive/1.15 This release series is longer active. Use backport/ent/1.15. backport-inactive/1.16 This release series is no longer active labels Apr 8, 2024
@dduzgun-security dduzgun-security removed backport-inactive/1.17 This release series is no longer active. Use backport/ent/1.17. backport/1.18 labels Apr 8, 2024
zalimeni
zalimeni approved these changes Apr 8, 2024
View reviewed changes
website/content/docs/connect/proxies/envoy.mdx Outdated Show resolved Hide resolved
@dduzgun-security @zalimeni
Update website/content/docs/connect/proxies/envoy.mdx
159264f 
Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
@zalimeni zalimeni enabled auto-merge (squash) April 8, 2024 18:59
@zalimeni zalimeni merged commit 3152ac3 into main Apr 8, 2024
86 checks passed
@zalimeni zalimeni deleted the security/net-8946-8947-8948 branch April 8, 2024 19:18
@zalimeni zalimeni changed the title security: bump go, x/net and envoy versions [NET-8946 NET-8947 NET-8948] security: bump go, x/net and envoy versions Apr 8, 2024
zalimeni added a commit that referenced this pull request Apr 8, 2024
@zalimeni
ci: fix Envoy int test versions
df1aeb8 
Follow-up to #20956
This was referenced Apr 8, 2024
Merged
Merged
Merged
Merged
Merged
zalimeni added a commit that referenced this pull request Apr 8, 2024
@zalimeni
ci: fix Envoy int test versions (#20964)
ad23e96 
Follow-up to #20956
This was referenced Apr 8, 2024
Merged
Merged
Merged
Merged
zalimeni added a commit that referenced this pull request Apr 8, 2024
@zalimeni
ci: fix Envoy int test versions
02efba5 
Follow-up to #20956
zalimeni added a commit that referenced this pull request Apr 8, 2024
@zalimeni
ci: fix Envoy int test versions
385ac9f 
Follow-up to #20956
zalimeni added a commit that referenced this pull request Apr 8, 2024
@zalimeni
ci: fix Envoy int test versions
72d41c3 
Follow-up to #20956
zalimeni added a commit that referenced this pull request Apr 8, 2024
@hc-github-team-consul-core @zalimeni
Backport of ci: fix Envoy int test versions into release/1.16.x (#20966)
88921cb 
ci: fix Envoy int test versions

Follow-up to #20956

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
zalimeni added a commit that referenced this pull request Apr 8, 2024
@hc-github-team-consul-core @zalimeni
Backport of ci: fix Envoy int test versions into release/1.15.x (#20965)
74c9dcf 
ci: fix Envoy int test versions

Follow-up to #20956

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
zalimeni added a commit that referenced this pull request Apr 8, 2024
@hc-github-team-consul-core @zalimeni
Backport of ci: fix Envoy int test versions into release/1.17.x (#20967)
34016c9 
ci: fix Envoy int test versions

Follow-up to #20956

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zalimeni zalimeni zalimeni approved these changes

Assignees
No one assigned
Labels
pr/dependencies PR specifically updates dependencies of project pr/no-backport theme/api Relating to the HTTP API interface theme/contributing Additions and enhancements to community contributing materials theme/security type/ci Relating to continuous integration (CI) tooling for testing or releases type/docs Documentation needs to be created/updated/clarified
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@dduzgun-security @zalimeni