Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2024-45337 CVE-2024-45338 #8541

Merged
merged 1 commit into from
Dec 23, 2024
Merged

CVE-2024-45337 CVE-2024-45338 #8541

merged 1 commit into from
Dec 23, 2024

Conversation

kaovilai
Copy link
Member

@kaovilai kaovilai commented Dec 20, 2024 •
edited
Loading

Replaces #8514

Signed-off-by: Tiger Kaovilai [email protected]

Thank you for contributing to Velero!

Please add a summary of your change

go: upgraded golang.org/x/net v0.31.0 => v0.33.0
go: upgraded golang.org/x/crypto v0.29.0 => v0.31.0
go: upgraded golang.org/x/sync v0.9.0 => v0.10.0
go: upgraded golang.org/x/sys v0.27.0 => v0.28.0
go: upgraded golang.org/x/term v0.26.0 => v0.27.0
go: upgraded golang.org/x/text v0.20.0 => v0.21.0

Does your change fix a particular issue?

Fixes #(issue)

Please indicate you've done the following:

/kind changelog-not-required

@kaovilai
CVE-2024-45337 CVE-2024-45338
8cb04bb 
Replaces vmware-tanzu#8514

Signed-off-by: Tiger Kaovilai <[email protected]>
@kaovilai kaovilai added the kind/changelog-not-required PR does not require a user changelog. Often for docs, website, or build changes label Dec 20, 2024
@kaovilai kaovilai marked this pull request as ready for review December 20, 2024 18:01
@github-actions github-actions bot added the Dependencies Pull requests that update a dependency file label Dec 20, 2024
@kaovilai kaovilai mentioned this pull request Dec 20, 2024
Closed
@codecov Codecov
Copy link

codecov bot commented Dec 20, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.17%. Comparing base (e85f18d) to head (8cb04bb).
Report is 2 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8541      +/-   ##
==========================================
- Coverage   59.18%   59.17%   -0.02%     
==========================================
  Files         369      369              
  Lines       39413    39413              
==========================================
- Hits        23327    23323       -4     
- Misses      14617    14620       +3     
- Partials     1469     1470       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

reasonerjt
reasonerjt approved these changes Dec 23, 2024
View reviewed changes
Copy link
Contributor

@reasonerjt reasonerjt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@reasonerjt reasonerjt merged commit 703a726 into vmware-tanzu:main Dec 23, 2024
47 of 48 checks passed
@gilrosenberg
Copy link

Do you plan to release patch version for this fix? If yes, when is this planed?

@blackpiglet
Copy link
Contributor

@gilrosenberg
The v1.15.1 will include the CVE fixes.
The target is the beginning of next month.

@kaovilai
Copy link
Member Author

An equivalent PR for 1.15 is #8526

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@blackpiglet blackpiglet blackpiglet approved these changes

@reasonerjt reasonerjt reasonerjt approved these changes

@anshulahuja98 anshulahuja98 Awaiting requested review from anshulahuja98

@Lyndon-Li Lyndon-Li Awaiting requested review from Lyndon-Li

Assignees

@kaovilai kaovilai

Labels
Dependencies Pull requests that update a dependency file kind/changelog-not-required PR does not require a user changelog. Often for docs, website, or build changes
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@kaovilai @gilrosenberg @blackpiglet @reasonerjt