Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: critical vulnerabilities in dependencies #3632

Merged
merged 4 commits into from
Jul 19, 2023

Conversation

avdhesh-devtron
Copy link
Contributor

@avdhesh-devtron avdhesh-devtron commented Jul 13, 2023

Description

Fixes for following vulnerabilities
CVE-2022-41721 critical golang.org/x/net
CVE-2022-41723 critical golang.org/x/net
CVE-2022-48195 critical mellium.im/sasl
CVE-2023-2253 critical github.com/docker/distribution

Fixes #
Versions of the dependencies have been bumped up
golang.org/x/net v0.0.0-20220722155237-a158d28d115b -> 0.7.0
mellium.im/sasl v0.2.1 -> 0.3.1
github.com/docker/distribution v2.8.1+incompatible -> 2.8.2

How Has This Been Tested?

  1. Image with these changes have been tested with Trivy.
  2. Build was deployed in local cluster and following flows have been tested
    • GitOps was enabled
    • New app was created and built, with and without Dockerfile.
    • Configurations for old apps were modified.

Checklist:

  • The title of the PR states what changed and the related issues number (used for the release note).
  • Does this PR requires documentation updates?
  • I've updated documentation as required by this PR.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have tested it for all user roles.
  • I have added all the required unit/api test cases.

Does this PR introduce a user-facing change?

NO


@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@avdhesh-devtron avdhesh-devtron merged commit d729c7d into main Jul 19, 2023
@avdhesh-devtron avdhesh-devtron deleted the fix-vulnerabilities-crit branch July 19, 2023 11:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants