Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE 8feb24 patch/v1.27 #14

Merged
merged 47 commits into from
Feb 12, 2024
Merged

CVE 8feb24 patch/v1.27 #14

merged 47 commits into from
Feb 12, 2024

Conversation

jbohanon
Copy link

@jbohanon jbohanon commented Feb 9, 2024

Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

phlax and others added 30 commits December 15, 2023 19:55
@phlax
deps/tooling: Make cve data preload optional (envoyproxy#30589)
06929b3 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
bazel/deps: Add updater tool (envoyproxy#30368)
27a1448 
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@phlax
github/ci: Update branch to new framework
999ffb7 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
deps: Bump com_github_grpc_grpc -> 1.59.1 (envoyproxy#30370)
e99a9ad 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
ci: Shift windows and macos jobs to github
76e4d65 
Signed-off-by: Ryan Northey <ryan@synca.io>
@soulxu @phlax
CI: explicitly specify the service want to start for kafka and websoc…
1ad5967 
…ket example (envoyproxy#31175)

Signed-off-by: He Jie Xu <hejie.xu@intel.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@dependabot @phlax
build(deps): bump distroless/base-nossl-debian12 from bad3646 to `8…
9e2eec7 
…a0cabc` in /ci (envoyproxy#31322)

build(deps): bump distroless/base-nossl-debian12 in /ci

Bumps distroless/base-nossl-debian12 from `bad3646` to `8a0cabc`.

---
updated-dependencies:
- dependency-name: distroless/base-nossl-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
docker/build: Update Ubuntu base image
b92053e 
Signed-off-by: Ryan Northey <ryan@synca.io>
@doujiang24 @phlax
examples/grpc: fix go.mod (envoyproxy#31299)
1ed1fb5 
Signed-off-by: doujiang24 <doujiang24@gmail.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@doujiang24 @phlax
examples/grpc: remove useless go.mod (envoyproxy#31318)
4c871d8 
also introduce the empty.go file to import the protobuf package,
which will be imported from the generated kv.pb.go file.

Signed-off-by: doujiang24 <doujiang24@gmail.com>

Signed-off-by: Ryan Northey <ryan@synca.io>
@suniltheta @phlax
deps: Bump com_github_curl -> 8.4.0 (envoyproxy#30088)
0290902 
Signed-off-by: Sunil Narasimhamurthy <sunnrs@amazon.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
tooling/deps: CVE updates
5ca4acf 
Signed-off-by: Ryan Northey <ryan@synca.io>
@doujiang24 @phlax
golang: fix replace path in go.mod (envoyproxy#31297)
23bfb50 
golang: fix path in replace.

Signed-off-by: doujiang24 <doujiang24@gmail.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@dependabot @phlax
build(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 in /contrib/g…
9bf0fdd 
…olang/router/cluster_specifier/test/test_data/simple

Dependabot couldn't find the original pull request head commit, 31ecd83498872ed5ac58fdae6775a6e6daa99f1f.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump google.golang.org/grpc
745c2a3 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.2 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.56.2...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump google.golang.org/grpc in /examples/grpc-bridge/server
e563329 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.53.0 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.53.0...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump google.golang.org/grpc
8ddcd92 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.2 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.56.2...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump golang.org/x/net in /examples/grpc-bridge/server
ffe8aaf 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump envoy-dependency-check in /tools/base
629758e 
Bumps [envoy-dependency-check](https://github.com/envoyproxy/toolshed) from 0.1.10 to 0.1.11.
- [Release notes](https://github.com/envoyproxy/toolshed/releases)
- [Commits](envoyproxy/toolshed@0.1.10...0.1.11)

---
updated-dependencies:
- dependency-name: envoy-dependency-check
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump google.golang.org/grpc
efff40e 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.25.1 to 1.56.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.25.1...v1.56.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @phlax
build(deps): bump distroless/base-nossl-debian12 from 8a0cabc to `8…
698c194 
…c957f0` in /ci (envoyproxy#31389)

build(deps): bump distroless/base-nossl-debian12 in /ci

Bumps distroless/base-nossl-debian12 from `8a0cabc` to `8c957f0`.

---
updated-dependencies:
- dependency-name: distroless/base-nossl-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
bazel/deps: Shift edenhill/kakfa dep -> confluentinc (envoyproxy#31393)
49d1aad 
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@phlax
bazel/updater: Use workaround to filter deps + format fix (envoyproxy…
d7b4053 
…#31397)

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@phlax
deps/tooling: Fix for CVE scanner
fcad60f 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
deps/tooling: Add CI paths
43d2e2d 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
deps: Rename edenhill -> confluentinc
89aaab4 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
docs/examples: Assorted cleanups (envoyproxy#31588)
596b716 
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@dgoffredo
datadog: fix names in Span::spawnChild (envoyproxy#31593)
be8b96c 
Signed-off-by: David Goffredo <david.goffredo@datadoghq.com>
@zhxie @phlax
deps: bump Boost to 1.84.0 (envoyproxy#31566)
15b30f4 
Signed-off-by: Xie Zhihao <zhihao.xie@intel.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@dgoffredo @phlax
datadog: fix span error property
da23aa4 
Signed-off-by: David Goffredo <david.goffredo@datadoghq.com>
phlax and others added 17 commits January 18, 2024 15:32
@phlax
debs/build: Bump Ubuntu base image -> f2034e7
8c8f6b2 
Signed-off-by: Ryan Northey <ryan@synca.io>
@dependabot @phlax
build(deps): bump distroless/base-nossl-debian12 from 8c957f0 to `5…
3663ae5 
…1ab103` in /ci (envoyproxy#32159)

build(deps): bump distroless/base-nossl-debian12 in /ci

Bumps distroless/base-nossl-debian12 from `8c957f0` to `51ab103`.

---
updated-dependencies:
- dependency-name: distroless/base-nossl-debian12
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
deps/build: Bump Ubuntu base image -> bb1c41
2371cfc 
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
deps/tooling: Bump python (~vulnerable) dependencies
15ab92b 
Signed-off-by: Ryan Northey <ryan@synca.io>
@dependency-envoy @phlax
deps: Bump com_github_grpc_grpc -> 1.59.3 (envoyproxy#31641)
9ba5055 
Signed-off-by: Ryan Northey <ryan@synca.io>
Co-authored-by: dependency-envoy[bot] <148525496+dependency-envoy[bot]@users.noreply.github.com>
@RyanTheOptimist @phlax
coverage: lower coverage for source/common/io/ (envoyproxy#32150)
22195f3 
Coverage CI is failing because coverage is too low in source/common/io because CI is not executing io_uring code. envoyproxy#32149

Signed-off-by: Ryan Hamilton <rch@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@tonya11en @phlax
deps: Bump com_github_grpc_grpc from 1.59.3 -> 1.59.4 (envoyproxy#3…
29ad926 
…2235)

Signed-off-by: Tony Allen <tony@allen.gg>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
release/ci: Fix artefact publishing (envoyproxy#31837)
96d2db4 
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@phlax
verify/examples: Expect/allow failure for local_ratelimit (envoyproxy…
aae5eb4 
…#31348)

envoyproxy#31347

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: phlax <phlax@users.noreply.github.com>
@phlax
ci/release: Ensure windows is built on release
8d5e0d9 
Signed-off-by: Ryan Northey <ryan@synca.io>
@jacobneiltaylor @phlax
Fix crash from AWS NLB healthchecks when proxy protocol is enabled
c6fe0ac 
Fix: [CVE-2024-23327](GHSA-4h5x-x9vh-m29j)

Signed-off-by: Jacob Neil Taylor <me@jacobtaylor.id.au>
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@yanavlasov @phlax
Fix crash when idle and per try timeouts occurs within backoff interval
84ffb38 
Fix [CVE-2024-23322](GHSA-6p83-mfmh-qv38)

Signed-off-by: yavlasov <yavlasov@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: yanavlasov <yavlasov@google.com>
@yanavlasov @phlax
Cache RE object in uri template matcher.
d41d61a 
Fix [CVE-2024-23323](GHSA-x278-4w4x-r7ch)

Signed-off-by: yavlasov <yavlasov@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: yanavlasov <yavlasov@google.com>
@ggreenway @phlax
Fix crashes when using address type that isn't supported by the OS
b096572 
Fix [CVE-2024-23325](GHSA-5m7c-mrwr-pm26)

Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
Proxy protocol: sanitise non utf8 chars in TLVs
4795bf3 
Fix [CVE-2024-23324](GHSA-gq3v-vvhj-96j6)

Signed-off-by: Kateryna Nezdolii <nezdolik@spotify.com>
Signed-off-by: Ryan Northey <ryan@synca.io>
@phlax
repo: Release v1.27.3
0fd81ee 
**Summary of changes**:

- Fix [CVE-2024-23324](GHSA-gq3v-vvhj-96j6)
- Fix [CVE-2024-23325](GHSA-5m7c-mrwr-pm26)
- Fix [CVE-2024-23322](GHSA-6p83-mfmh-qv38)
- Fix [CVE-2024-23323](GHSA-x278-4w4x-r7ch)
- Fix [CVE-2024-23327](GHSA-4h5x-x9vh-m29j)
- Assorted bug fixes

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.27.3
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.27.3/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.27.3/version_history/v1.27/v1.27.3
**Full changelog**:
    envoyproxy/envoy@v1.27.2...v1.27.3

Signed-off-by: Ryan Northey <ryan@synca.io>
@jbohanon
Merge branch 'release/v1.27' of ssh://github.com/envoyproxy/envoy int…
c64d121 
…o cve-8feb24-patch/v1.27
@nfuden nfuden merged commit ebfb8ff into release/v1.27-backportedfork Feb 12, 2024
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nfuden nfuden nfuden approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone