search

kubernetes / ingress-nginx

Ingress-NGINX Controller for Kubernetes
https://kubernetes.github.io/ingress-nginx/
Apache License 2.0
16.95k stars 8.14k forks source link

[Vulnerabilities] current version of nginx-ingress-controller v1.10.1 has many vulnerabilties #11396

Open abhilashaSingh4042 opened 1 month ago

abhilashaSingh4042 commented 1 month ago
  1. Alpine Linux Security Update for libxml2: solution
  2. GO (Go) Security Update for golang.org/x/net/http2 (GHSA-4v7x-pqxf-cx7m): solution
  3. Alpine Linux 3.19 Security Update for openssl : solution
  4. Alpine Linux Security Update for busybox: solution
longwuyuan commented 1 month ago

The x/net and the openssl will get patched in the next release of the ingress-nginx controller

abhilashaSingh4042 commented 1 month ago

@longwuyuan when can we expect next release?

longwuyuan commented 1 month ago

Maintainers will start working on it next week

moazrefat commented 1 month ago

@longwuyuan ingress controller v1.10.1 is using 1.25.3 which is end of life, when we we expect new version with v1.26 or v1.27 ? https://endoflife.date/nginx

longwuyuan commented 1 month ago

The controller does NOT use NGINX in the way that people would assume.

The controller uses OpenResty and hence the version of Nginx visible is what is bundled with the version of OpenResty used.

Tons of patches are backported and nginx itself is compiled from src. So the EOL you are talking about seems relevant but is acceptable.

strongjz commented 1 month ago

@abhilashaSingh4042, all of these will be updated in a patch release. This month has been difficult. We have a maintainer stepping down, and I, primarily responsible for releases, was out on vacation for most of the month. We will get back into our regular patching soon. Please be patient. There is a lot of work on and very few people contributing.

/assign @strongjz /triage accepted /priority important-soon

yehiyam commented 4 days ago

Hi @strongjz Any update on the next patch release? Also, anything I can do to help? Any "easy" issues I can tackle?

Shreya2810 commented 4 days ago

@strongjz ingress controller v1.10.1 is using 1.25.3 which is end of life, when we expect new version with v1.26 or v1.27 ?

scottstout commented 3 days ago

@strongjz is there an ETA on this? Are you even able to resolve this issue without a new release from OpenResty?

longwuyuan commented 3 days ago

@scottstout Please look at the list of PRs merged yesterday and opened yesterday. The wok to release the next version is underway. This involved rebuilding images with updated libraries and so the patches/fixes released by upstream alpine and others get applied to the new release.

Nginx version is not binaries downloaded but patched builds so we are good on Nginx version. Several of those Nginx CVEs related to vanilla nginx and not a Openresty related component that is built from src.

strongjz commented 3 days ago

We're onboarding a new maintainer who has never done a release before, one stepped down last month, and I was out sick for a week after my vacation and had other work arrangements that required my time. We are trying our best to get this out. When we kick a build of nginx it takes an hour or so, if it fails, we have to spend time understanding why it failed, and which new component caused the failure. That all takes a considerable amount of time.

Please be patient with us, there are a lot of constraints and we are trying our best.

All of these will be in the 1.11 release, the goal is this week.

strongjz commented 3 days ago

The build failed last night https://github.com/kubernetes/ingress-nginx/actions/runs/9765301748/job/26961062322#step:6:2097

We have to ensure that the CI passes for 4 versions of Kubernetes, on helm and with our 3 deployments, normal, chroot, with validations enabled. All of those have to pass for a new image to be promoted.