Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-3.4] Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 #17347

Merged
merged 1 commit into from
Jan 31, 2024
Merged

[release-3.4] Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 #17347

merged 1 commit into from
Jan 31, 2024

Conversation

serathius
Copy link
Member

Ref #17345

@serathius serathius force-pushed the crypto-3.4 branch 2 times, most recently from 12b9adb to b360e39 Compare January 30, 2024 10:52
@serathius serathius changed the title Bump golang.org/x/crypto to v0.17.0 to address CVE-2023-48795 Bump golang.org/x/crypto to v0.18.0 to address CVE-2023-48795 Jan 30, 2024
@serathius serathius changed the title Bump golang.org/x/crypto to v0.18.0 to address CVE-2023-48795 Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 Jan 30, 2024
@serathius
Copy link
Member Author

Not sure why by the minimal package combination on release-3.4 branch gives me newer packages than on release-3.5.

@serathius serathius changed the title Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 [release-3.4] Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795 Jan 30, 2024
ahrtr
ahrtr approved these changes Jan 30, 2024
View reviewed changes
Copy link
Member

@ahrtr ahrtr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@serathius serathius force-pushed the crypto-3.4 branch 2 times, most recently from aad2cd2 to b49deb5 Compare January 31, 2024 09:50
@serathius
Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
b6b36c9 
This is the minimal set of package updates I get after:

taking packages from release-3.5 with golang.org/x/crypto@v0.17.0
slowly downgrading package by package to get minimal changes
running make to make sure other dependencies don't change

Signed-off-by: Marek Siarkowicz <siarkowicz@google.com>
@serathius
Copy link
Member Author

serathius commented Jan 31, 2024 •
edited
Loading

managed to minimize the dependency dump, by taking go.mod from release-3.5 branch and working down to find a dependencies that blocked usage of 0.17.0. Now we don't need to bump up to 0.18.0 nor upgrade grpc.

@serathius serathius mentioned this pull request Jan 31, 2024
Merged
@serathius
Copy link
Member Author

/retest

@serathius serathius merged commit 8bd1fac into etcd-io:release-3.4 Jan 31, 2024
12 checks passed
@ahrtr ahrtr mentioned this pull request Jan 31, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ahrtr ahrtr ahrtr approved these changes

Assignees
No one assigned
Labels
stage/merge-when-tests-green
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@serathius @ahrtr