vulnerabilities fixes - Githubissues

opendatahub-io / modelmesh-serving

Controller for ModelMesh

Apache License 2.0

3 stars 31 forks source link

vulnerabilities fixes #254

Closed spolti closed 9 months ago

spolti commented 9 months ago

chore: This commit fixes the following CVEs:

CVE-2023-37788: github.com/elazarl/goproxy Denial of Service (DoS)
CVE-2022-21698 / CVE-2023-45142: Allocation of Resources Without Limits or Throttling

Motivation

Modifications

Result

PR checklist

Checklist items below are applicable for development targeted to both fast and stable branches/tags

[ ] Unit tests pass locally
[ ] FVT tests pass locally
[ ] If the PR adds a new container image or updates the tag of an existing image (not build within cpaas), is the corresponding change made in live-builder and cpaas-midstream to add/update the image tag in the operator CSV? Link the PRs if applicable

Checklist items below are applicable for development targeted to both fast and stable branches/tags

[ ] Tested modelmesh serving deployment with odh-manifests and ran odh-manifests-e2e tests locally

openshift-ci[bot] commented 9 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: israel-hdez, spolti

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/opendatahub-io/modelmesh-serving/blob/main/OWNERS)~~ [israel-hdez] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment