thoth-station / common

A common library for the Thoth project
https://thoth-station.github.io/
GNU General Public License v3.0
4 stars 19 forks source link

kubernetes module version 11.0.0 has CVE #1251

Open goern opened 2 years ago

goern commented 2 years ago

Is your feature request related to a problem? Please describe. https://github.com/thoth-station/common/blob/master/requirements.txt#L10 declares a dependency on kubernetes, current versions v11.0.0 is affected by https://access.redhat.com/security/cve/cve-2020-1747

This results in all our container images having a critical security issue, for example: https://quay.io/repository/thoth-station/integration-tests/manifest/sha256:7d4195a824800c12b63b011e29f2f1ffc7e623a3753373cd5c2c5c775b3ac7df?tab=vulnerabilities

Describe the solution you'd like update kubernetes dependency to new version, release new patch version of thoth-common

Describe alternatives you've considered n/a

Additional context

Update to v12.0.0 can be done, due to the issue https://github.com/thoth-station/common/issues/1273 wait for a better release and testing.

Acceptance criteria

harshad16 commented 1 year ago

Changing the priority as upgrading to v12.0.0 kubernetes would cause failure in user-api. /priority important-soon /lifecycle frozen /triage accepted

Any upgrade of kubernetes and openshift version, should be tested in user-api as well.

codificat commented 1 year ago

I think this is more: /remove-kind feature /kind bug