Skip to content

Commit 1f2e64b

Browse files
authored
Typos and wrong link (#5791)
1 parent 740d717 commit 1f2e64b

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

blog/docs/events/security-audit-2023.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Knative Extensions are optional plugins and extensions for different Knative use
1414

1515
Ada Logics found 16 security issues of which all except for one have been fixed with upstream patches. Three of the found issues are in third-party dependencies to Knative. One of the issues found is scored with high severity due to its potential impact (ADA-KNATIVE-23-7). However, an attacker would need to compromise the Knative user’s supply-chain, which is highly unlikely to occur in a real-world scenario because few Knative users consume Knative in a way that would enable the attack. In addition, the attacker would need to time their attack to a high degree. The issue has been fixed.
1616

17-
One CVE was assigned during the audit for a vulnerability that could allow an attacker with already escalated privileges to cause further damage in the cluster. The attacker needs to first establish a position in a Knative pod, and from there, they could exploit the vulnerability and cause denial of service of the Knative autoscaling, thereby denying any autoscaling of Knative. The issue was assigned CVE-2023-48713 of Moderate severity and has been fixed in v1.10.5, v1.12.0 and v1.11.3.
17+
One CVE was assigned during the audit for a vulnerability that could allow an attacker with already escalated privileges to cause further damage in the cluster. The attacker needs to first establish a position in a Knative pod, and from there, they could exploit the vulnerability and cause denial of service of the Knative autoscaling, thereby denying any autoscaling of Knative. The issue was assigned CVE-2023-48713 of Moderate severity and has been fixed in v1.12.0, v1.11.3 and v1.10.5.
1818

1919
Prior to the audit, Knative had invested in building its own [provenance generator](https://github.com/knative/toolbox/tree/main/provenance-generator) which generates slsa-compliant provenance and adds it to releases. Users can verify the provenance using [the official SLSA guidelines](https://slsa.dev/spec/v1.0/verifying-artifacts) before consuming. The Knative maintainers found that Knative Serving was missing a few lines of Prow configuration which resulted in Knative Serving releases not having provenance. This was fixed [here](https://github.com/knative/infra/pull/288) which ensures that future releases of Knative Serving will include verifiable provenance.
2020

blog/docs/index.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Follow this blog to keep up-to-date with Knative.
2323
## Featured Posts
2424

2525
### Knative Completes Third-Party Security Audit
26-
A third-party audit by Ada Logics found a small number of issues, including [one CVE](https://github.com/knative/docs/pull/5788).
26+
A third-party audit by Ada Logics found a small number of issues, including [one CVE](https://github.com/knative/serving/security/advisories/GHSA-qmvj-4qr9-v547).
2727

2828
[Read more :octicons-arrow-right-24:](events/security-audit-2023.md){ .md-button }
2929

0 commit comments

Comments
 (0)