[CVE-2023-44487] Disable http2 for webhooks #2871

skonto · 2023-10-20T15:10:10Z

Changes

Disables http2 by default for webhooks. Allows to set it on demand via options.
Similar to fix: disable HTTP2 connections by default prometheus-operator/prometheus-operator#6028.

Fixes # CVE-2023-44487 (partially)

Release Note

Due to CVE-2023-44487 webhooks will use http1 by default, until the issue is fixed properly.

knative-prow · 2023-10-20T15:10:13Z

@skonto: The label(s) kind/<kind> cannot be applied, because the repository doesn't have them.

In response to this:

Changes

Disables http2 by default for webhooks. Allows to to set it on demand via options.

Similar to fix: disable HTTP2 connections by default prometheus-operator/prometheus-operator#6028.

/kind

Fixes #

Release Note
Docs

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

codecov · 2023-10-20T15:17:56Z

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (d6ab729) 81.88% compared to head (4269f48) 81.86%.
Report is 2 commits behind head on main.

❗ Current head 4269f48 differs from pull request most recent head 7af1062. Consider uploading reports for the commit 7af1062 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2871      +/-   ##
==========================================
- Coverage   81.88%   81.86%   -0.03%     
==========================================
  Files         167      167              
  Lines       10225    10230       +5     
==========================================
+ Hits         8373     8375       +2     
- Misses       1606     1608       +2     
- Partials      246      247       +1

Files	Coverage Δ
webhook/webhook.go	`82.16% <40.00%> (-1.39%)`	⬇️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

skonto · 2023-10-23T08:46:18Z

cc @dprotaso

dprotaso · 2023-10-23T13:57:23Z

webhook/webhook.go

@@ -245,12 +256,18 @@ func (wh *Webhook) Run(stop <-chan struct{}) error {
 		QuietPeriod: wh.Options.GracePeriod,
 	}

+	nextProto := map[string]func(*http.Server, *tls.Conn, http.Handler){}


can we add a comment that
// If TLSNextProto is not nil, HTTP/2 support is not enabled automatically.

dprotaso · 2023-10-23T14:03:22Z

/cherry-pick release-1.11

knative-prow-robot · 2023-10-23T14:03:23Z

@dprotaso: once the present PR merges, I will cherry-pick it on top of release-1.11 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dprotaso · 2023-10-23T14:03:26Z

/cherry-pick release-1.12

knative-prow-robot · 2023-10-23T14:03:27Z

@dprotaso: once the present PR merges, I will cherry-pick it on top of release-1.12 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dprotaso · 2023-10-23T14:06:29Z

/cherry-pick release-1.12

knative-prow-robot · 2023-10-23T14:06:31Z

@dprotaso: once the present PR merges, I will cherry-pick it on top of release-1.12 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dprotaso · 2023-10-23T14:30:01Z

/lgtm
/approve

knative-prow · 2023-10-23T14:30:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dprotaso, skonto

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~webhook/OWNERS~~ [dprotaso,skonto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

knative-prow-robot · 2023-10-23T14:38:59Z

@dprotaso: new pull request created: #2875

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

knative-prow-robot · 2023-10-23T14:39:38Z

@dprotaso: new pull request created: #2876

In response to this:

/cherry-pick release-1.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dprotaso · 2023-10-23T15:01:16Z

/cherry-pick release-1.10

knative-prow-robot · 2023-10-23T15:01:52Z

@dprotaso: #2871 failed to apply on top of branch "release-1.10":

Applying: disable http2 for webhooks
Using index info to reconstruct a base tree...
M	webhook/webhook.go
Falling back to patching base and 3-way merge...
Auto-merging webhook/webhook.go
CONFLICT (content): Merge conflict in webhook/webhook.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 disable http2 for webhooks
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

disable http2 for webhooks

4269f48

knative-prow bot requested review from kauana and KauzClay October 20, 2023 15:10

skonto changed the title ~~[WIP] Disable http2 for webhooks~~ [WIP] [CVE-2023-44487] Disable http2 for webhooks Oct 20, 2023

skonto changed the title ~~[WIP] [CVE-2023-44487] Disable http2 for webhooks~~ [CVE-2023-44487] Disable http2 for webhooks Oct 23, 2023

knative-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 23, 2023

dprotaso reviewed Oct 23, 2023

View reviewed changes

add comment

7af1062

knative-prow bot assigned dprotaso Oct 23, 2023

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 23, 2023

knative-prow bot merged commit b8c14ce into knative:main Oct 23, 2023
40 checks passed

knative-prow-robot mentioned this pull request Oct 23, 2023

[release-1.11] [CVE-2023-44487] Disable http2 for webhooks #2875

Merged

knative-prow-robot mentioned this pull request Oct 23, 2023

[release-1.12] [CVE-2023-44487] Disable http2 for webhooks #2876

Merged

skonto mentioned this pull request Oct 23, 2023

[release-1.10] Allow to disable http2 for the webhook #2877

Merged

ReToCode mentioned this pull request Nov 1, 2023

Disable HTTP/2 for webhooks until a fix come #2881

Closed

jkandasa mentioned this pull request Nov 16, 2023

[v0.53.x] bump knative version to get a CVE fix tektoncd/pipeline#7372

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CVE-2023-44487] Disable http2 for webhooks #2871

[CVE-2023-44487] Disable http2 for webhooks #2871

skonto commented Oct 20, 2023 •

edited

knative-prow bot commented Oct 20, 2023

Changes

codecov bot commented Oct 20, 2023 •

edited

skonto commented Oct 23, 2023

dprotaso Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow bot commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

[CVE-2023-44487] Disable http2 for webhooks #2871

[CVE-2023-44487] Disable http2 for webhooks #2871

Conversation

skonto commented Oct 20, 2023 • edited

Changes

knative-prow bot commented Oct 20, 2023

Changes

codecov bot commented Oct 20, 2023 • edited

Codecov Report

skonto commented Oct 23, 2023

dprotaso Oct 23, 2023

Choose a reason for hiding this comment

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow bot commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

dprotaso commented Oct 23, 2023

knative-prow-robot commented Oct 23, 2023

skonto commented Oct 20, 2023 •

edited

codecov bot commented Oct 20, 2023 •

edited