Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

irLinja · 2024-02-01T19:34:38Z

This fixes the CVE-2023-5363 and CVE-2023-5528 mentioned in the issue #620

k8s-ci-robot · 2024-02-01T19:34:47Z

Welcome @irLinja!

It looks like this is your first PR to kubernetes/dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-02-01T19:34:48Z

Hi @irLinja. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

irLinja · 2024-02-14T19:26:20Z

/honk

k8s-ci-robot · 2024-02-14T19:26:22Z

@irLinja:

In response to this:

/honk

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

irLinja · 2024-02-17T13:24:14Z

I'd appreciate your review.
/cc kl52752
/cc mrhohn
/cc bowei

zengyuxing007 · 2024-03-19T05:53:02Z

@irLinja Do you have any information on why this modification can fix the mentioned CVE vulnerability? Thank you.

irLinja · 2024-03-19T08:05:13Z

@zengyuxing007 I ran a vulnerability scanner on the new version and there are no known vulnerabilities as of now.

kl52752 · 2024-03-21T07:46:14Z

/ok-to-test

zhangguanzhang · 2024-03-22T03:11:52Z

maybe update to

registry.k8s.io/build-image/distroless-iptables:v0.5.2

irLinja · 2024-03-22T08:43:34Z

Done 👍🏼

irLinja · 2024-03-26T18:26:50Z

Can someone review this, please?

Signed-off-by: Arash Haghighat <arash@linja.pro>

kl52752 · 2024-03-27T08:53:11Z

Can you link info why upgrading iptables will fix those Vuln issues?
Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables

zhangguanzhang · 2024-03-27T11:10:53Z

Can you link info why upgrading iptables will fix those Vuln issues? Latest version for iptables is v0.5.6 https://pkg.go.dev/github.com/docker/libnetwork/iptables

# skopeo list-tags docker://registry.k8s.io/build-image/distroless-iptables
{
    "Repository": "registry.k8s.io/build-image/distroless-iptables",
    "Tags": [
        "v0.1.0",
        "v0.1.1",
        "v0.1.2",
        "v0.2.0",
        "v0.2.1",
        "v0.2.10",
        "v0.2.2",
        "v0.2.3",
        "v0.2.4",
        "v0.2.5",
        "v0.2.6",
        "v0.2.7",
        "v0.2.8",
        "v0.2.9",
        "v0.3.0",
        "v0.3.1",
        "v0.3.2",
        "v0.3.3",
        "v0.4.0",
        "v0.4.1",
        "v0.4.2",
        "v0.4.3",
        "v0.4.4",
        "v0.4.5",
        "v0.4.6",
        "v0.5.0",
        "v0.5.1",
        "v0.5.2"
    ]
}

zhangguanzhang · 2024-03-27T11:12:12Z

@kl52752

[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.4.1
2024-03-27T19:11:26.860+0800	INFO	Vulnerability scanning is enabled
2024-03-27T19:11:26.860+0800	INFO	Secret scanning is enabled
2024-03-27T19:11:26.860+0800	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:11:26.860+0800	INFO	Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:11:28.494+0800	INFO	Detected OS: debian
2024-03-27T19:11:28.494+0800	INFO	Detecting Debian vulnerabilities...
2024-03-27T19:11:28.498+0800	INFO	Number of language-specific files: 0

registry.k8s.io/build-image/distroless-iptables:v0.4.1 (debian 12.2)

Total: 24 (UNKNOWN: 0, LOW: 16, MEDIUM: 5, HIGH: 3, CRITICAL: 0)

┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬──────────────────┬──────────────────────────────────────────────────────────────┐
│   Library    │  Vulnerability   │ Severity │    Status    │ Installed Version │  Fixed Version   │                            Title                             │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781    │ LOW      │ will_not_fix │ 9.1-1             │                  │ coreutils: Non-privileged session can escape to the parent   │
│              │                  │          │              │                   │                  │ session in chroot                                            │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2016-2781                    │
│              ├──────────────────┤          ├──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2017-18018   │          │ affected     │                   │                  │ coreutils: race condition vulnerability in chown and chgrp   │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2017-18018                   │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ iptables     │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libc6        │ CVE-2023-6246    │ HIGH     │ fixed        │ 2.36-9+deb12u3    │ 2.36-9+deb12u4   │ glibc: heap-based buffer overflow in __vsyslog_internal()    │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6246                    │
│              ├──────────────────┤          │              │                   │                  ├──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6779    │          │              │                   │                  │ glibc: off-by-one heap-based buffer overflow in              │
│              │                  │          │              │                   │                  │ __vsyslog_internal()                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6779                    │
│              ├──────────────────┼──────────┤              │                   │                  ├──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6780    │ MEDIUM   │              │                   │                  │ glibc: integer overflow in __vsyslog_internal()              │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6780                    │
│              ├──────────────────┼──────────┼──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-4756    │ LOW      │ affected     │                   │                  │ glibc: glob implementation can cause excessive CPU and       │
│              │                  │          │              │                   │                  │ memory consumption due to...                                 │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2018-20796   │          │              │                   │                  │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │                  │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010022 │          │              │                   │                  │ glibc: stack guard protection bypass                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010023 │          │              │                   │                  │ glibc: running ldd on malicious ELF leads to code execution  │
│              │                  │          │              │                   │                  │ because of...                                                │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010024 │          │              │                   │                  │ glibc: ASLR bypass using cache of thread stack and heap      │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010025 │          │              │                   │                  │ glibc: information disclosure of heap addresses of           │
│              │                  │          │              │                   │                  │ pthread_created thread                                       │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-9192    │          │              │                   │                  │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │                  │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2    │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┤                  │          │              │                   ├──────────────────┤                                                              │
│ libip6tc2    │                  │          │              │                   │                  │                                                              │
│              │                  │          │              │                   │                  │                                                              │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4  │ CVE-2020-36325   │          │              │ 2.14-2            │                  │ jansson: out-of-bounds read in json_loads() due to a parsing │
│              │                  │          │              │                   │                  │ error                                                        │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2020-36325                   │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2023-5363    │ HIGH     │ fixed        │ 3.0.11-1~deb12u1  │ 3.0.11-1~deb12u2 │ openssl: Incorrect cipher key and IV length processing       │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-5363                    │
│              ├──────────────────┼──────────┼──────────────┤                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-5678    │ MEDIUM   │ affected     │                   │                  │ openssl: Generating excessively long X9.42 DH keys or        │
│              │                  │          │              │                   │                  │ checking excessively long X9.42...                           │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-5678                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6129    │          │              │                   │                  │ openssl: POLY1305 MAC implementation corrupts vector         │
│              │                  │          │              │                   │                  │ registers on PowerPC                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6129                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6237    │          │              │                   │                  │ openssl: Excessive time spent checking invalid RSA public    │
│              │                  │          │              │                   │                  │ keys                                                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2023-6237                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2024-0727    │          │              │                   │                  │ openssl: denial of service via null dereference              │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2024-0727                    │
│              ├──────────────────┼──────────┤              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2007-6755    │ LOW      │              │                   │                  │ Dual_EC_DRBG: weak pseudo random number generator            │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2007-6755                    │
│              ├──────────────────┤          │              │                   ├──────────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-0928    │          │              │                   │                  │ openssl: RSA authentication weakness                         │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2010-0928                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼──────────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663    │          │              │ 1.8.9-2           │                  │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │                  │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴──────────────────┴──────────────────────────────────────────────────────────────┘

kl52752 · 2024-03-27T11:48:17Z

thanks, can you also run trivy image for iptables v0.5.2 image?

zhangguanzhang · 2024-03-27T11:59:32Z

thanks, can you also run trivy image for iptables v0.5.2 image?

HIGH: 0, CRITICAL: 0

[root@guan ~]# trivy image registry.k8s.io/build-image/distroless-iptables:v0.5.2
2024-03-27T19:58:42.924+0800	INFO	Vulnerability scanning is enabled
2024-03-27T19:58:42.924+0800	INFO	Secret scanning is enabled
2024-03-27T19:58:42.924+0800	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-03-27T19:58:42.924+0800	INFO	Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-03-27T19:58:44.150+0800	INFO	Detected OS: debian
2024-03-27T19:58:44.150+0800	INFO	Detecting Debian vulnerabilities...
2024-03-27T19:58:44.152+0800	INFO	Number of language-specific files: 0

registry.k8s.io/build-image/distroless-iptables:v0.5.2 (debian 12.5)

Total: 20 (UNKNOWN: 0, LOW: 16, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌──────────────┬──────────────────┬──────────┬──────────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│   Library    │  Vulnerability   │ Severity │    Status    │ Installed Version │ Fixed Version │                            Title                             │
├──────────────┼──────────────────┼──────────┼──────────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ coreutils    │ CVE-2016-2781    │ LOW      │ will_not_fix │ 9.1-1             │               │ coreutils: Non-privileged session can escape to the parent   │
│              │                  │          │              │                   │               │ session in chroot                                            │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2016-2781                    │
│              ├──────────────────┤          ├──────────────┤                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2017-18018   │          │ affected     │                   │               │ coreutils: race condition vulnerability in chown and chgrp   │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2017-18018                   │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ iptables     │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libc6        │ CVE-2010-4756    │          │              │ 2.36-9+deb12u4    │               │ glibc: glob implementation can cause excessive CPU and       │
│              │                  │          │              │                   │               │ memory consumption due to...                                 │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2010-4756                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2018-20796   │          │              │                   │               │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2018-20796                   │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010022 │          │              │                   │               │ glibc: stack guard protection bypass                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010022                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010023 │          │              │                   │               │ glibc: running ldd on malicious ELF leads to code execution  │
│              │                  │          │              │                   │               │ because of...                                                │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010023                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010024 │          │              │                   │               │ glibc: ASLR bypass using cache of thread stack and heap      │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010024                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-1010025 │          │              │                   │               │ glibc: information disclosure of heap addresses of           │
│              │                  │          │              │                   │               │ pthread_created thread                                       │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-1010025                 │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2019-9192    │          │              │                   │               │ glibc: uncontrolled recursion in function                    │
│              │                  │          │              │                   │               │ check_dst_limits_calc_pos_1 in posix/regexec.c               │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2019-9192                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libip4tc2    │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
├──────────────┤                  │          │              │                   ├───────────────┤                                                              │
│ libip6tc2    │                  │          │              │                   │               │                                                              │
│              │                  │          │              │                   │               │                                                              │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libjansson4  │ CVE-2020-36325   │          │              │ 2.14-2            │               │ jansson: out-of-bounds read in json_loads() due to a parsing │
│              │                  │          │              │                   │               │ error                                                        │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2020-36325                   │
├──────────────┼──────────────────┼──────────┤              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libssl3      │ CVE-2023-5678    │ MEDIUM   │              │ 3.0.11-1~deb12u2  │               │ openssl: Generating excessively long X9.42 DH keys or        │
│              │                  │          │              │                   │               │ checking excessively long X9.42...                           │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-5678                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6129    │          │              │                   │               │ openssl: POLY1305 MAC implementation corrupts vector         │
│              │                  │          │              │                   │               │ registers on PowerPC                                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-6129                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2023-6237    │          │              │                   │               │ openssl: Excessive time spent checking invalid RSA public    │
│              │                  │          │              │                   │               │ keys                                                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2023-6237                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2024-0727    │          │              │                   │               │ openssl: denial of service via null dereference              │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2024-0727                    │
│              ├──────────────────┼──────────┤              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2007-6755    │ LOW      │              │                   │               │ Dual_EC_DRBG: weak pseudo random number generator            │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2007-6755                    │
│              ├──────────────────┤          │              │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│              │ CVE-2010-0928    │          │              │                   │               │ openssl: RSA authentication weakness                         │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2010-0928                    │
├──────────────┼──────────────────┤          │              ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libxtables12 │ CVE-2012-2663    │          │              │ 1.8.9-2           │               │ iptables: --syn flag bypass                                  │
│              │                  │          │              │                   │               │ https://avd.aquasec.com/nvd/cve-2012-2663                    │
└──────────────┴──────────────────┴──────────┴──────────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

irLinja · 2024-03-27T12:10:21Z

@zhangguanzhang, thanks for providing the scan results.

kl52752 · 2024-03-27T12:24:47Z

/lgtm
/approve

k8s-ci-robot · 2024-03-27T12:25:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: irLinja, kl52752

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [kl52752]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Feb 1, 2024

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Feb 1, 2024

k8s-ci-robot requested review from bowei and MrHohn February 1, 2024 19:34

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Feb 1, 2024

k8s-ci-robot requested a review from kl52752 February 17, 2024 13:24

irLinja force-pushed the issue-620/CVE-2023-5363-and-CVE-2023-5528 branch from 061fb56 to 7911823 Compare March 19, 2024 16:59

This comment has been minimized.

Sign in to view

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 21, 2024

irLinja force-pushed the issue-620/CVE-2023-5363-and-CVE-2023-5528 branch from 7911823 to 7c9a356 Compare March 22, 2024 08:42

irLinja changed the title ~~upgrade IPT image version for vuln fixes~~ vuln fixes fixes the CVE-2023-5363 and CVE-2023-5528 Mar 22, 2024

irLinja changed the title ~~vuln fixes fixes the CVE-2023-5363 and CVE-2023-5528~~ Vuln fixes for CVE-2023-5363 and CVE-2023-5528 Mar 22, 2024

fix: upgrade IPT image to 0.5.2 for vuln patches

2ca25c8

Signed-off-by: Arash Haghighat <arash@linja.pro>

irLinja force-pushed the issue-620/CVE-2023-5363-and-CVE-2023-5528 branch from 7c9a356 to 2ca25c8 Compare March 26, 2024 18:27

k8s-ci-robot assigned kl52752 Mar 27, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 27, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 27, 2024

k8s-ci-robot merged commit df76fe3 into kubernetes:master Mar 27, 2024
3 checks passed

irLinja deleted the issue-620/CVE-2023-5363-and-CVE-2023-5528 branch March 27, 2024 12:29

bzsuni mentioned this pull request Jun 6, 2024

Update kube-dns and nodelocaldns to 1.23.1 kubernetes/kubernetes#125284

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

irLinja commented Feb 1, 2024

k8s-ci-robot commented Feb 1, 2024

k8s-ci-robot commented Feb 1, 2024

irLinja commented Feb 14, 2024

k8s-ci-robot commented Feb 14, 2024

irLinja commented Feb 17, 2024

zengyuxing007 commented Mar 19, 2024

irLinja commented Mar 19, 2024 •

edited

Loading

This comment has been minimized.

kl52752 commented Mar 21, 2024

zhangguanzhang commented Mar 22, 2024

irLinja commented Mar 22, 2024 •

edited

Loading

irLinja commented Mar 26, 2024

kl52752 commented Mar 27, 2024 •

edited

Loading

zhangguanzhang commented Mar 27, 2024

zhangguanzhang commented Mar 27, 2024

kl52752 commented Mar 27, 2024

zhangguanzhang commented Mar 27, 2024 •

edited

Loading

irLinja commented Mar 27, 2024

kl52752 commented Mar 27, 2024

k8s-ci-robot commented Mar 27, 2024

Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

Vuln fixes for CVE-2023-5363 and CVE-2023-5528 #622

Conversation

irLinja commented Feb 1, 2024

k8s-ci-robot commented Feb 1, 2024

k8s-ci-robot commented Feb 1, 2024

irLinja commented Feb 14, 2024

k8s-ci-robot commented Feb 14, 2024

irLinja commented Feb 17, 2024

zengyuxing007 commented Mar 19, 2024

irLinja commented Mar 19, 2024 • edited Loading

This comment has been minimized.

kl52752 commented Mar 21, 2024

zhangguanzhang commented Mar 22, 2024

irLinja commented Mar 22, 2024 • edited Loading

irLinja commented Mar 26, 2024

kl52752 commented Mar 27, 2024 • edited Loading

zhangguanzhang commented Mar 27, 2024

zhangguanzhang commented Mar 27, 2024

kl52752 commented Mar 27, 2024

zhangguanzhang commented Mar 27, 2024 • edited Loading

irLinja commented Mar 27, 2024

kl52752 commented Mar 27, 2024

k8s-ci-robot commented Mar 27, 2024

irLinja commented Mar 19, 2024 •

edited

Loading

irLinja commented Mar 22, 2024 •

edited

Loading

kl52752 commented Mar 27, 2024 •

edited

Loading

zhangguanzhang commented Mar 27, 2024 •

edited

Loading