Skip to content

Contour v0.14.2

Choose a tag to compare

View all tags
@davecheney davecheney released this 14 Aug 00:10
v0.14.2
b297a5f

Contour 0.14.2 is a bug fix and security release for the Contour 0.14 series.

All Contour users should upgrade to Contour 0.14.2.

HTTP/2 CVEs

A number of CVEs related to HTTP/2 have been addressed by Envoy.

See the Envoy 1.11.1 announcement for details on the vulnerabilities.

As Envoy have not provided fixes for Envoy 1.10 and earlier all Contour users should upgrade to Envoy 1.11.1. As Contour and Envoy have a close coupling between versions, all Contour users should upgrade to Contour 0.14.2 at the same time.

See the upgrading section below for details.

Go 1.12.8

A similar set of issues related to HTTP/2 and URL parsing has been addressed in Go 1.12.8

See the Go 1.12.8 announcement for details on the vulnerabilities.

Contour 0.14.2 is built using Go 1.12.8 to mitigate these issues.

Contour crash if /tmp is not available

The glog (now klog) library would attempt to write to disk if not properly initialised. Contour 0.14.2 properly initialises klog to prevent this issue. Fixes #1279. Thanks to @so0k for the report and @mattalberts for the fix.

Upgrading

If you are already running Contour 0.14.0, or 0.14.1, the upgrade instructions are as follows:

  • Change the Contour image version to gcr.io/heptio-images/contour:v0.14.2.
  • Change the Envoy image version to docker.io/envoyproxy/envoy:v1.11.1.

If you are running Contour 0.13.0 or earlier, please see the release notes for the previous release.

Assets 2
Loading