Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix medium severity CVEs #159

Merged
merged 2 commits into from
Jun 12, 2024
Merged

Conversation

yash-acquia
Copy link
Contributor

@yash-acquia yash-acquia commented Jun 11, 2024

What happened?
An orca scan detected the following CVEs:
GHSA-7ww5-4wqc-m92c
CVE-2023-2253
CVE-2023-45288

What are we trying to fix?
Upgrading the patch version of gobinary packages.

Vulnerability_id Package Name Vulnerable Version Patch Version Type
GHSA-7ww5-4wqc-m92c github.com/containerd/containerd v1.6.18 1.6.26 gobinary
CVE-2023-2253 github.com/docker/distribution v2.8.1+incompatible 2.8.2-beta.1 gobinary
CVE-2023-45288 golang.org/x/net v0.22.0 v0.23.0 gobinary

Environment

  • Kubernetes version: v1.28.9-eks
  • CSI driver image and version: docker.io/warmmetal/csi-image v1.2.2

@yash-acquia yash-acquia marked this pull request as ready for review June 11, 2024 13:18
@yash-acquia yash-acquia requested a review from a team as a code owner June 11, 2024 13:18
@mugdha-adhav
Copy link
Collaborator

@yash-acquia could you also update the version to v1.2.3 in Chart.yaml and Makefile, so that we don't need another PR for this. You may refer last commit on how to do it.

@mugdha-adhav mugdha-adhav merged commit e6e93b3 into warm-metal:main Jun 12, 2024
@yash-acquia yash-acquia deleted the fix-cves branch July 23, 2024 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants