Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Backport release-1.28] Fix CVE-2023-45288 #4257

Merged
merged 8 commits into from
Apr 10, 2024
Merged

[Backport release-1.28] Fix CVE-2023-45288 #4257

merged 8 commits into from
Apr 10, 2024

Conversation

twz123
Copy link
Member

@twz123 twz123 commented Apr 9, 2024

dependabot bot and others added 8 commits April 9, 2024 12:51
@dependabot @twz123
Bump golang.org/x/sys from 0.15.0 to 0.16.0
2f768f6 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.15.0 to 0.16.0.
- [Commits](golang/sys@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 3abd703)
@dependabot @twz123
Bump golang.org/x/crypto from 0.17.0 to 0.18.0
1f5bd2a 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.17.0 to 0.18.0.
- [Commits](golang/crypto@v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 1af8b2b)
@dependabot @twz123
Bump golang.org/x/sys from 0.16.0 to 0.17.0
b0297ef 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.16.0 to 0.17.0.
- [Commits](golang/sys@v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit be0998b)
(cherry picked from commit caa6093)
@dependabot @twz123
Bump golang.org/x/crypto from 0.18.0 to 0.19.0
164f341 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.18.0 to 0.19.0.
- [Commits](golang/crypto@v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 73ea428)
(cherry picked from commit 4b9c633)
@dependabot @twz123
Bump golang.org/x/crypto from 0.19.0 to 0.20.0
0f4044a 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.19.0 to 0.20.0.
- [Commits](golang/crypto@v0.19.0...v0.20.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit ce4d201)
(cherry picked from commit 4b0df6c)
@dependabot @twz123
Bump golang.org/x/sys from 0.17.0 to 0.18.0
2666268 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.17.0 to 0.18.0.
- [Commits](golang/sys@v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sys
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 99d7642)
(cherry picked from commit 99ab917)
@dependabot @twz123
Bump golang.org/x/crypto from 0.20.0 to 0.21.0
b184c66 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.20.0 to 0.21.0.
- [Commits](golang/crypto@v0.20.0...v0.21.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit f60840a)
(cherry picked from commit 5f59a23)
@twz123
Bump golang.org/x/net to v0.23.0
237e1ae 
This fixes CVE-2023-45288.

Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
(cherry picked from commit b43f3a1)
(cherry picked from commit c562360)
@twz123 twz123 added security fix backport/release-1.27 PR that needs to be backported/cherrypicked to release-1.27 branch labels Apr 9, 2024
@twz123 twz123 mentioned this pull request Apr 9, 2024
Merged
@twz123 twz123 marked this pull request as ready for review April 10, 2024 07:43
@twz123 twz123 requested a review from a team as a code owner April 10, 2024 07:43
@twz123 twz123 requested review from ncopa and makhov April 10, 2024 07:43
@twz123 twz123 merged commit 0e6bec4 into k0sproject:release-1.28 Apr 10, 2024
73 checks passed
@twz123 twz123 deleted the backport-4256-to-release-1.28 branch April 10, 2024 07:43
@k0s-bot
Copy link

k0s-bot commented Apr 10, 2024

Backport failed for release-1.27, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally.

git fetch origin release-1.27
git worktree add -d .worktree/backport-4257-to-release-1.27 origin/release-1.27
cd .worktree/backport-4257-to-release-1.27
git checkout -b backport-4257-to-release-1.27
ancref=$(git merge-base 8dc2b806bd9da6e7cbebf8f90f314dc61793fe1b 237e1ae6987d7db623b03e36b4cd9aa91ff64e47)
git cherry-pick -x $ancref..237e1ae6987d7db623b03e36b4cd9aa91ff64e47

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jnummelin jnummelin jnummelin approved these changes

@ncopa ncopa Awaiting requested review from ncopa ncopa is a code owner automatically assigned from k0sproject/k0s-maintainers

@makhov makhov Awaiting requested review from makhov makhov is a code owner automatically assigned from k0sproject/k0s-maintainers

Assignees
No one assigned
Labels
backport/release-1.27 PR that needs to be backported/cherrypicked to release-1.27 branch security fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@twz123 @k0s-bot @jnummelin