Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable HTTP/2 for webhooks until a fix come #2881

Closed
khrm opened this issue Oct 31, 2023 · 4 comments
Closed

Disable HTTP/2 for webhooks until a fix come #2881

khrm opened this issue Oct 31, 2023 · 4 comments
Labels
kind/bug Categorizes issue or PR as related to a bug. kind/security Issues or PRs related to security or CVEs.

Comments

@khrm
Copy link

khrm commented Oct 31, 2023

We need to disable HTTP/2 for webhooks.

"
The go runtime does have a fix to mitigate the GHSA-qppj-fm5r-hxr3 to a degree, but as kubernetes/kubernetes#121197 shows, a single connection attempting to perform a denial-of-service attack against a go-based HTTP/2 server resulted in the server process quickly consuming 5 GB of memory. Additional connections would likely result in an OOM situation very quickly.
"
Please check this: kubernetes/kubernetes#121197

@khrm
Copy link
Author

khrm commented Oct 31, 2023

/kind security

@knative-prow knative-prow bot added the kind/security Issues or PRs related to security or CVEs. label Oct 31, 2023
@khrm
Copy link
Author

khrm commented Oct 31, 2023

/kind bug

@knative-prow knative-prow bot added the kind/bug Categorizes issue or PR as related to a bug. label Oct 31, 2023
@khrm khrm changed the title HTTP/2 for webhooks until a fix come Disable HTTP/2 for webhooks until a fix come Oct 31, 2023
@ReToCode
Copy link
Member

ReToCode commented Nov 1, 2023

Hey @khrm,
This is already done, check out
#2871
#2877
#2876
#2875

@ReToCode ReToCode closed this as completed Nov 1, 2023
@khrm
Copy link
Author

khrm commented Nov 1, 2023

@ReToCode Thanks. We will do the release for Tekton after updating with the fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/bug Categorizes issue or PR as related to a bug. kind/security Issues or PRs related to security or CVEs.
Projects
None yet
Development

No branches or pull requests

2 participants