Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(cve): update dependencies #1214

Merged
merged 1 commit into from
Sep 9, 2024

Conversation

c3y1huang
Copy link
Contributor

@c3y1huang c3y1huang commented Sep 6, 2024

Which issue(s) this PR fixes:

Issue longhorn/longhorn#9132

What this PR does / why we need it:

Fix CVE issues.

After

c3y1huang/research:2098-lh-ei (suse linux enterprise server 15.5)
=================================================================
Total: 0 (HIGH: 0, CRITICAL: 0)

Before

longhornio/longhorn-engine:v1.6.x-head (suse linux enterprise server 15.5)
==========================================================================
Total: 0 (HIGH: 0, CRITICAL: 0)


usr/local/bin/grpc_health_probe (gobinary)
==========================================
Total: 2 (HIGH: 1, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                           Title                            │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2024-24790 │ CRITICAL │ fixed  │ 1.21.5            │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for │
│         │                │          │        │                   │                 │ IPv4-mapped IPv6 addresses                                 │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-24790                 │
│         ├────────────────┼──────────┤        │                   ├─────────────────┼────────────────────────────────────────────────────────────┤
│         │ CVE-2023-45288 │ HIGH     │        │                   │ 1.21.9, 1.22.2  │ golang: net/http, x/net/http2: unlimited number of         │
│         │                │          │        │                   │                 │ CONTINUATION frames causes DoS                             │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-45288                 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴────────────────────────────────────────────────────────────┘

Special notes for your reviewer:

We don't need to backport to the other branches, as CVE issues are handled independently for each version and will be addressed before each release.

Additional documentation or context

None

@c3y1huang
Copy link
Contributor Author

c3y1huang commented Sep 6, 2024

Test result: longhorn/longhorn#9410 (comment)

longhorn/longhorn-9132

Signed-off-by: Chin-Ya Huang <chin-ya.huang@suse.com>
Copy link
Member

@derekbit derekbit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@derekbit derekbit merged commit 24b0f1b into longhorn:v1.6.x Sep 9, 2024
8 checks passed
@c3y1huang c3y1huang deleted the 9132-fix-cve-issues branch September 9, 2024 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants