-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kubernetes module version 11.0.0 has CVE #1251
Labels
kind/bug
Categorizes issue or PR as related to a bug.
lifecycle/frozen
Indicates that an issue or PR should not be auto-closed due to staleness.
priority/critical-urgent
Highest priority. Must be actively worked on as someone's top priority right now.
sig/devsecops
Categorizes an issue or PR as relevant to SIG DevSecOps.
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
Comments
sesheta
added
priority/critical-urgent
Highest priority. Must be actively worked on as someone's top priority right now.
sig/devsecops
Categorizes an issue or PR as relevant to SIG DevSecOps.
labels
Apr 7, 2022
2 tasks
harshad16
changed the title
upgrade minimum version of kubernetes module to 12.0.0a1
kubernetes module version 11.0.0 has CVE
Aug 16, 2022
Changing the priority as upgrading to v12.0.0 kubernetes would cause failure in user-api. Any upgrade of kubernetes and openshift version, should be tested in user-api as well.
|
sesheta
added
lifecycle/frozen
Indicates that an issue or PR should not be auto-closed due to staleness.
priority/important-soon
Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
labels
Aug 16, 2022
harshad16
removed
the
priority/critical-urgent
Highest priority. Must be actively worked on as someone's top priority right now.
label
Aug 16, 2022
I think this is more: |
sesheta
added
kind/bug
Categorizes issue or PR as related to a bug.
and removed
kind/feature
Categorizes issue or PR as related to a new feature.
labels
Oct 7, 2022
codificat
added
priority/critical-urgent
Highest priority. Must be actively worked on as someone's top priority right now.
and removed
priority/important-soon
Must be staffed and worked on either currently, or very soon, ideally in time for the next release.
labels
Nov 21, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
kind/bug
Categorizes issue or PR as related to a bug.
lifecycle/frozen
Indicates that an issue or PR should not be auto-closed due to staleness.
priority/critical-urgent
Highest priority. Must be actively worked on as someone's top priority right now.
sig/devsecops
Categorizes an issue or PR as relevant to SIG DevSecOps.
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
Is your feature request related to a problem? Please describe.
https://github.com/thoth-station/common/blob/master/requirements.txt#L10 declares a dependency on kubernetes, current versions v11.0.0 is affected by https://access.redhat.com/security/cve/cve-2020-1747
This results in all our container images having a critical security issue, for example: https://quay.io/repository/thoth-station/integration-tests/manifest/sha256:7d4195a824800c12b63b011e29f2f1ffc7e623a3753373cd5c2c5c775b3ac7df?tab=vulnerabilities
Describe the solution you'd like
update kubernetes dependency to new version, release new patch version of thoth-common
Describe alternatives you've considered
n/a
Additional context
Update to v12.0.0 can be done,
due to the issue #1273
wait for a better release and testing.
Acceptance criteria
common/thoth/common/openshift.py
Line 103 in a9a2365
The text was updated successfully, but these errors were encountered: