Update knative/pkg 1.11 to address CVE-2023-44487 #7210

khrm · 2023-10-13T11:02:03Z

Updated knative/pkg to latest in branch 1.11 so that we can fix CVE-2023-44487.

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

Updated knative/pkg to latest in branch 1.11 so that we can address CVE-2023-44487.

khrm · 2023-10-13T11:02:21Z

/kind misc
/kind security

khrm · 2023-10-13T11:03:20Z

/test check-pr-has-kind-label

tekton-robot · 2023-10-13T11:03:22Z

@khrm: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-beta-integration-tests
/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-integration-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

khrm · 2023-10-13T11:12:17Z

/test all

vdemeester

/approve
/lgtm

tekton-robot · 2023-10-13T12:33:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vdemeester · 2023-10-13T12:34:09Z

/test check-pr-has-kind-label

tekton-robot · 2023-10-13T12:34:10Z

@vdemeester: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-beta-integration-tests
/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-integration-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

JeromeJu · 2023-10-13T14:16:23Z

/test check-pr-has-kind-label

tekton-robot · 2023-10-13T14:16:26Z

@JeromeJu: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-beta-integration-tests
/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-integration-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

jerop

/test check-pr-has-kind-label

tekton-robot · 2023-10-13T15:27:12Z

@jerop: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-beta-integration-tests
/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-integration-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Yongxuanzhang · 2023-10-13T21:08:00Z

/kind misc /kind security

We can only set 1 kind for each PR

Yongxuanzhang · 2023-10-13T21:08:09Z

/test check-pr-has-kind-label

tekton-robot · 2023-10-13T21:08:11Z

@Yongxuanzhang: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-beta-integration-tests
/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-integration-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vdemeester · 2023-10-16T08:42:26Z

/cherry-pick release-v0.52.x

tekton-robot · 2023-10-16T08:43:06Z

@vdemeester: #7210 failed to apply on top of branch "release-v0.52.x":

Applying: Update knative/pkg 1.11 to address CVE-2023-44487
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/golang.org/x/net/http2/server.go
M	vendor/golang.org/x/sys/unix/syscall_linux.go
M	vendor/golang.org/x/sys/unix/zerrors_linux.go
M	vendor/golang.org/x/sys/unix/zsyscall_linux.go
M	vendor/golang.org/x/sys/unix/ztypes_linux.go
M	vendor/golang.org/x/sys/windows/syscall_windows.go
M	vendor/golang.org/x/sys/windows/zsyscall_windows.go
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Auto-merging vendor/golang.org/x/sys/windows/zsyscall_windows.go
Auto-merging vendor/golang.org/x/sys/windows/syscall_windows.go
Auto-merging vendor/golang.org/x/sys/unix/ztypes_linux.go
Auto-merging vendor/golang.org/x/sys/unix/zsyscall_linux.go
Auto-merging vendor/golang.org/x/sys/unix/zerrors_linux.go
Auto-merging vendor/golang.org/x/sys/unix/syscall_linux.go
CONFLICT (content): Merge conflict in vendor/golang.org/x/sys/unix/syscall_linux.go
Removing vendor/golang.org/x/sys/internal/unsafeheader/unsafeheader.go
Auto-merging vendor/golang.org/x/net/http2/server.go
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Update knative/pkg 1.11 to address CVE-2023-44487
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-v0.52.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Update knative/pkg 1.11 to address CVE-2023-44487

30f8d43

Updated knative/pkg to latest in branch 1.11 so that we can address CVE-2023-44487.

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Oct 13, 2023

tekton-robot requested review from bobcatfish and chitrangpatel October 13, 2023 11:02

tekton-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 13, 2023

tekton-robot added kind/misc Categorizes issue or PR as a miscellaneuous one. kind/security Categorizes issue or PR as related to a security issue labels Oct 13, 2023

khrm closed this Oct 13, 2023

khrm reopened this Oct 13, 2023

vdemeester approved these changes Oct 13, 2023

View reviewed changes

tekton-robot assigned vdemeester Oct 13, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 13, 2023

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 13, 2023

jerop reviewed Oct 13, 2023

View reviewed changes

Yongxuanzhang removed the kind/misc Categorizes issue or PR as a miscellaneuous one. label Oct 13, 2023

tekton-robot merged commit 140b986 into tektoncd:main Oct 13, 2023
3 checks passed

khrm deleted the cve-http2 branch October 16, 2023 05:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update knative/pkg 1.11 to address CVE-2023-44487 #7210

Update knative/pkg 1.11 to address CVE-2023-44487 #7210

khrm commented Oct 13, 2023 •

edited

Loading

khrm commented Oct 13, 2023

khrm commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

khrm commented Oct 13, 2023

vdemeester left a comment

tekton-robot commented Oct 13, 2023

vdemeester commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

JeromeJu commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

jerop left a comment

tekton-robot commented Oct 13, 2023

Yongxuanzhang commented Oct 13, 2023

Yongxuanzhang commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

vdemeester commented Oct 16, 2023

tekton-robot commented Oct 16, 2023

Update knative/pkg 1.11 to address CVE-2023-44487 #7210

Update knative/pkg 1.11 to address CVE-2023-44487 #7210

Conversation

khrm commented Oct 13, 2023 • edited Loading

Changes

Submitter Checklist

Release Notes

khrm commented Oct 13, 2023

khrm commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

khrm commented Oct 13, 2023

vdemeester left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 13, 2023

vdemeester commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

JeromeJu commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

jerop left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 13, 2023

Yongxuanzhang commented Oct 13, 2023

Yongxuanzhang commented Oct 13, 2023

tekton-robot commented Oct 13, 2023

vdemeester commented Oct 16, 2023

tekton-robot commented Oct 16, 2023

khrm commented Oct 13, 2023 •

edited

Loading