openshift / assisted-installer-agent

Apache License 2.0
24 stars 74 forks source link

OCPBUGS-33146: [release-4.14] OCPBUGS-16483: Update apimachinery dependency to remove goproxy dep #709

Open rwsu opened 2 months ago

rwsu commented 2 months ago

This is a manual cherrypick of PR#590

A denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). goproxy is not used directly by the agent. It is pulled in by apimachinery. apimachinery ceases to use goproxy after v0.27.0.

To prevent the potential issue, apimachiney is updated to v0.27.2.

openshift-ci-robot commented 2 months ago

@rwsu: This pull request references Jira Issue OCPBUGS-16483, which is invalid:

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to [this](https://github.com/openshift/assisted-installer-agent/pull/709): >This is a manual cherrypick of [PR#590](https://github.com/openshift/assisted-installer-agent/pull/590) > >A denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). goproxy is not used directly by the agent. It is pulled in by apimachinery. apimachinery ceases to use goproxy after v0.27.0. > >To prevent the potential issue, apimachiney is updated to v0.27.2. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fassisted-installer-agent). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci[bot] commented 2 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rwsu Once this PR has been reviewed and has the lgtm label, please assign paul-maidment for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/openshift/assisted-installer-agent/blob/release-4.14/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
rwsu commented 2 months ago

/jira cherrypick OCPBUGS-16483

openshift-ci-robot commented 2 months ago

@rwsu: Jira Issue OCPBUGS-16483 has been cloned as Jira Issue OCPBUGS-33146. Will retitle bug to link to clone. /retitle OCPBUGS-33146: [release-4.14] OCPBUGS-16483: Update apimachinery dependency to remove goproxy dep

In response to [this](https://github.com/openshift/assisted-installer-agent/pull/709#issuecomment-2087304665): >/jira cherrypick OCPBUGS-16483 Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fassisted-installer-agent). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci-robot commented 2 months ago

@rwsu: This pull request references Jira Issue OCPBUGS-33146, which is invalid:

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to [this](https://github.com/openshift/assisted-installer-agent/pull/709): >This is a manual cherrypick of [PR#590](https://github.com/openshift/assisted-installer-agent/pull/590) > >A denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). goproxy is not used directly by the agent. It is pulled in by apimachinery. apimachinery ceases to use goproxy after v0.27.0. > >To prevent the potential issue, apimachiney is updated to v0.27.2. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fassisted-installer-agent). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci[bot] commented 2 months ago

@rwsu: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).