From 0ecd40eedf1183195a9f0d60c35eb892ae9d11f0 Mon Sep 17 00:00:00 2001 From: HagayVider1 Date: Tue, 26 Mar 2024 00:51:05 +0200 Subject: [PATCH 1/6] Created MTC 1.7.15 release notes --- .../migration-mtc-release-notes-1-7-14.adoc | 41 +++---------------- .../migration-mtc-release-notes-1-7-15.adoc | 21 ++++++++++ 2 files changed, 26 insertions(+), 36 deletions(-) create mode 100644 modules/migration-mtc-release-notes-1-7-15.adoc diff --git a/modules/migration-mtc-release-notes-1-7-14.adoc b/modules/migration-mtc-release-notes-1-7-14.adoc index 42a2d2a4e479..4f4a587e70ca 100644 --- a/modules/migration-mtc-release-notes-1-7-14.adoc +++ b/modules/migration-mtc-release-notes-1-7-14.adoc @@ -2,48 +2,17 @@ // // * migration_toolkit_for_containers/mtc-release-notes.adoc :_mod-docs-content-type: REFERENCE -[id="migration-mtc-release-notes-1-7-14_{context}"] -= {mtc-full} 1.7.14 release notes +[id="migration-mtc-release-notes-1-7-15_{context}"] += {mtc-full} 1.7.15 release notes -[id="resolved-issues-1-7-14_{context}"] +[id="resolved-issues-1-7-15_{context}"] == Resolved issues This release has the following resolved issues: -.CVE-2023-39325 CVE-2023-44487: various flaws +. -A flaw was found in the handling of multiplexed streams in the HTTP/2 protocol, which is utilized by {mtc-full} ({mtc-short}). A client could repeatedly make a request for a new multiplex stream then immediately send an `RST_STREAM` frame to cancel those requests. This activity created additional workloads for the server in terms of setting up and dismantling streams, but avoided any server-side limitations on the maximum number of active streams per connection. As a result, a denial of service occurred due to server resource consumption. - -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2243564[(BZ#2243564)] -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2244013[(BZ#2244013)] -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2244014[(BZ#2244014)] -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2244015[(BZ#2244015)] -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2244016[(BZ#2244016)] -* link:https://bugzilla.redhat.com/show_bug.cgi?id=2244017[(BZ#2244017)] - -To resolve this issue, upgrade to {mtc-short} 1.7.14. - -For more details, see link:https://access.redhat.com/security/cve/cve-2023-44487[(CVE-2023-44487)] and link:https://access.redhat.com/security/cve/cve-2023-39325[(CVE-2023-39325)]. - -.CVE-2023-39318 CVE-2023-39319 CVE-2023-39321: various flaws - -* link:https://access.redhat.com/security/cve/cve-2023-39318[(CVE-2023-39318)]: A flaw was discovered in Golang, utilized by {mtc-short}. The `html/template` package did not properly handle HTML-like `""` comment tokens, or the hashbang `"#!"` comment tokens, in `