Closed tjungblu closed 1 week ago
note to myself, I need to update the CHANGELOG
@ahrtr I have rebased, but I don't think this workflow failure is related to this PR nor main.
new CVE? @ivanvc @jmhbnz @ArkaSaha30
Vulnerability #1: GO-2024-3250
Improper error handling in ParseWithClaims and bad documentation may cause
dangerous situations in github.com/golang-jwt/jwt
More info: https://pkg.go.dev/vuln/GO-2024-3250
Module: github.com/golang-jwt/jwt/v4
Found in: github.com/golang-jwt/jwt/v4@v4.4.2
Fixed in: github.com/golang-jwt/jwt/v4@v4.5.1
Example traces found:
Error: #1: auth/jwt.go:48:26: auth.tokenJWT.info calls jwt.Parse
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: ahrtr, jmhbnz, tjungblu
The full list of commands accepted by this bot can be found here.
The pull request process is described here
/retest
Edit: ah, we need a rebase to have green tests
@tjungblu would you mind rebasing this PR before we merge it? thx
done
/retest
This adds the min and max TLS version support from #13506 and #15156 to the grpc proxy.
Fixes #13506 Backport of #18816
Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.