CVE-2023-45288: overall tracker

[jkh52]

CVE-2023-45288 needs mitigation and releases.

Tasks

Beta Give feedback

1. Mitigate master (CVE-2023-45288: update golang.org/x/net to 1.23.0 #613)
2. Mitigate release-0.30 branch (CVE-2023-45288 (release-0.30): update golang.org/x/net to 1.23.0 #614)
3. Mitigate release-0.29 branch (Cherrypick update for 0.29, include fix CVE-2023-45288 #618)
4. Mitigate release-0.28 branch ([release-0.28] CVE-2023-45288: update golang.org/x/net to 1.23.0 #621)
5. Mitigate release-0.1 branch ([release-0.1] CVE-2023-45288: update golang.org/x/net to 1.23.0 #622)
6. Tag v0.30.3
7. Tag v0.29.3
8. Tag v0.28.6
9. Tag v0.1.10
10. Promote associated images (Publish network proxy images for v0.30.3, v0.29.3, v0.28.6 and v0.1.10. kubernetes/k8s.io#6819)
11. Update k/k master
12. Update k/k release-1.30
13. Update k/k release-1.29
14. Update k/k release-1.28
15. Update k/k release-1.27

[jkh52]

/cc @avrittrohwer
/cc @azimjohn

[liangyuanpeng]

I will open a PR to enable cherry-pick plugin of prow for ANP later, and then we just comment /cherry-pick release-0.29 at PR, the bot will cherry pick this PR to release-0.29 after this PR is merged.

let's automate as much as possible :)

[liangyuanpeng]

let's automate as much as possible :)

Updates to dependencies may not work because it may need to rerun go mod tidy. :(

[liangyuanpeng]

I will open a PR to enable cherry-pick plugin of prow for ANP later, and then we just comment /cherry-pick release-0.29 at PR, the bot will cherry pick this PR to release-0.29 after this PR is merged.

open the PR kubernetes/test-infra#32547 for it

[jkh52]

Mitigations for all supported versions are now merged. I will create tags soon.

[jkh52]

Mitigations for all supported versions are now merged. I will create tags soon.

Tags are created.

[mengdie-song]

Hi, could you help upload the 0.29.3 image with the CVE fix as well? I am trying to pull 0.29.3 image but got errors below.

docker pull registry.k8s.io/kas-network-proxy/proxy-agent:v0.29.3
Error response from daemon: manifest for registry.k8s.io/kas-network-proxy/proxy-agent:v0.29.3 not found: manifest unknown: Failed to fetch "v0.29.3"

Can I know when this 0.29.3 image will be ready? Thanks!