[3.5] Security: address HIGH Vulnerabilities #15018
Conversation
CVE-2021-44716 CVE-2022-27664 Signed-off-by: Benjamin Wang <[email protected]>
ahrtr
added
area/security
priority/important-soon
ahrtr
force-pushed
the
deps_3.5_20221219
branch
from
0c39439
to
56505f1
Compare
Signed-off-by: Benjamin Wang <[email protected]>
Signed-off-by: Benjamin Wang <[email protected]>
Signed-off-by: Benjamin Wang <[email protected]>
Signed-off-by: Benjamin Wang <[email protected]>
ahrtr
force-pushed
the
deps_3.5_20221219
branch
4 times, most recently
from
409b087
to
a172ce8
Compare
Signed-off-by: Benjamin Wang <[email protected]>
ahrtr
force-pushed
the
deps_3.5_20221219
branch
from
a172ce8
to
925c061
Compare
|
Please ignore the |
| @@ -13,7 +13,7 @@ jobs: | |||
| - uses: actions/checkout@v2 | |||
| - uses: actions/setup-go@v2 | |||
| with: | |||
| go-version: "1.16.15" | |||
There was a problem hiding this comment.
Right now, the 1.17.x is unsupported.
Just wonder that it will be great to use current stable version like 1.18.x or 1.19.x.
There was a problem hiding this comment.
I would minimize the changes (so keep 1.17), as we are already breaking the usual promise of the patch versions (due to etcd long lifecycle).
There was a problem hiding this comment.
minimize the changes
This was exactly what I was thinking. In the beginning, I bumped to go1.19.4 directly, but after second thought, I downgrade it to 1.17.13.
If all maintainers agree to bump 1.19.x, we can do it in a separate PR.
|
Thinking what consequences for k8s would have bumping the go version:
As etcd-3.5 will be live for a long time, I think we bump the version and let customer's (like k8s) decide whether they want to cary the CVE risk or not. Etcd version for k8s is not critical as the all http traffic is shielded through API server (assuming proper configuration of firewalls). |
| @@ -13,7 +13,7 @@ jobs: | |||
| - uses: actions/checkout@v2 | |||
| - uses: actions/setup-go@v2 | |||
| with: | |||
| go-version: "1.16.15" | |||
There was a problem hiding this comment.
I would minimize the changes (so keep 1.17), as we are already breaking the usual promise of the patch versions (due to etcd long lifecycle).
[3.5] Security: address HIGH Vulnerabilities
Firstly, bumped
golang.org/x/netto v0.4.0 to address some HIGH CVEs.Secondly,
golang.org/x/sysandgolang.org/x/textare also automatically bumped when bumpinggolang.org/x/net. They requires Go 1.17+. So let's bump go version to 1.17.13.cc @mitake @ptabor @serathius @spzala