Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of security: bump envoy version and k8s.io/apimachinery into release/1.15.x #21030

Merged
merged 2 commits into from
May 2, 2024
Merged

Backport of security: bump envoy version and k8s.io/apimachinery into release/1.15.x #21030

merged 2 commits into from
May 2, 2024

Conversation

dduzgun-security
Copy link
Contributor

Description

Upgrade to support Envoy 1.27.5, and 1.28.3.
This resolves CVE-2024-32475 (auto_sni).

Upgrade to support k8s.io/apimachinery to v0.18.7 or higher.
This resolves CVE-2020-8559.

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@dduzgun-security dduzgun-security requested a review from a team as a code owner May 2, 2024 15:21
@github-actions github-actions bot added type/docs Documentation needs to be created/updated/clarified type/ci Relating to continuous integration (CI) tooling for testing or releases pr/dependencies PR specifically updates dependencies of project theme/contributing Additions and enhancements to community contributing materials labels May 2, 2024
@hc-github-team-consul-core
Copy link
Collaborator

🤔 This PR has changes in the website/ directory but does not have a type/docs-cherrypick label. If the changes are for the next version, this can be ignored. If they are updates to current docs, attach the label to auto cherrypick to the stable-website branch after merging.

boruszak
boruszak approved these changes May 2, 2024
View reviewed changes
Copy link
Contributor

@boruszak boruszak left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Docs update to envoy.mdx LGTM.

Approving on behalf of consul-docs

@zalimeni zalimeni merged commit 6124e7e into release/1.15.x May 2, 2024
147 of 148 checks passed
@zalimeni zalimeni deleted the backport/security/net-7785/envoy-apimachinery/1.15.x branch May 2, 2024 17:36
@dduzgun-security dduzgun-security changed the title security: bump envoy version and k8s.io/apimachinery Backport of security: bump envoy version and k8s.io/apimachinery May 2, 2024
@dduzgun-security dduzgun-security changed the title Backport of security: bump envoy version and k8s.io/apimachinery Backport of security: bump envoy version and k8s.io/apimachinery into release/1.15.x May 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zalimeni zalimeni zalimeni approved these changes

@boruszak boruszak boruszak approved these changes

Assignees
No one assigned
Labels
pr/dependencies PR specifically updates dependencies of project pr/no-backport theme/contributing Additions and enhancements to community contributing materials type/ci Relating to continuous integration (CI) tooling for testing or releases type/docs Documentation needs to be created/updated/clarified
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@dduzgun-security @hc-github-team-consul-core @zalimeni @boruszak