Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1924476: handle CVE-2021-3121 #139

Merged
merged 1 commit into from Jun 5, 2021
Merged

Bug 1924476: handle CVE-2021-3121 #139

merged 1 commit into from Jun 5, 2021

Conversation

yboaron
Copy link
Contributor

@yboaron yboaron commented May 20, 2021

Set protobuf 1.3.2, check [1]

[1]
https://access.redhat.com/security/cve/CVE-2021-3121

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 20, 2021
@openshift-ci openshift-ci bot requested review from celebdor and cybertron May 20, 2021 11:56
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 20, 2021
@yboaron
Copy link
Contributor Author

yboaron commented May 20, 2021

/retitle Bug 1924476: handle CVE-2021-3121

@openshift-ci openshift-ci bot changed the title [WIP] Handle CVE-2021-3121 Bug 1924476: handle CVE-2021-3121 May 20, 2021
@openshift-ci openshift-ci bot added bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels May 20, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 20, 2021

@yboaron: This pull request references Bugzilla bug 1924476, which is invalid:

  • expected the bug to target the "4.8.0" release, but it targets "4.7.z" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1924476: handle CVE-2021-3121

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@yboaron
Copy link
Contributor Author

yboaron commented May 20, 2021

/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 20, 2021
cybertron
cybertron reviewed May 20, 2021
View reviewed changes
go.mod Outdated
@@ -31,3 +29,5 @@ require (
k8s.io/klog v0.3.3 // indirect
k8s.io/utils v0.0.0-20190607212802-c55fbcfc754a // indirect
)

replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we not just do:

go get github.com/gogo/protobuf
go mod vendor

to update this version?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I copy/paste from cluster-logging-operator fix

I guess we can use your approach

@cybertron
Copy link
Member

/bugzilla refresh
/refresh

@openshift-ci openshift-ci bot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label May 26, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 26, 2021

@cybertron: This pull request references Bugzilla bug 1924476, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.8.0) matches configured target release for branch (4.8.0)
  • bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (vvoronko@redhat.com), skipping review request.

In response to this:

/bugzilla refresh
/refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot removed the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label May 26, 2021
@cybertron
Copy link
Member

/retest
/facepalm ;-)

@cybertron
Copy link
Member

/lgtm

The ipv6 job passed, and the ipv4 one failed on something unrelated. I think you can remove the hold and merge this.

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 2, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 2, 2021

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cybertron, yboaron

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cybertron
Copy link
Member

/hold cancel

We're coming up on code freeze, let's get this in.

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 4, 2021
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

2 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 5, 2021 •
edited

@yboaron: The following test failed, say /retest to rerun all failed tests:

Test name Commit Details Rerun command
ci/prow/e2e-metal-ipi d3fcef4 link /test e2e-metal-ipi

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot merged commit e6b36b2 into openshift:master Jun 5, 2021
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 5, 2021

@yboaron: All pull requests linked via external trackers have merged:

Bugzilla bug 1924476 has been moved to the MODIFIED state.

In response to this:

Bug 1924476: handle CVE-2021-3121

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cybertron cybertron cybertron left review comments

@celebdor celebdor Awaiting requested review from celebdor

Assignees

@cybertron cybertron

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@yboaron @cybertron @openshift-bot @openshift-merge-robot