Update module github.com/sigstore/rekor to v1.2.0 [SECURITY] - autoclosed #18833
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
bot
added
dependencies
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: renovate[bot] The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
In the dependabot PR (closed) Miloslav said the size-increase is expected. Edit: Miloslav also said the impact/affect of the CVE on podman isn't great. So I don't think there's any rush to merge this. |
cevich
added
the
bloat_approved
|
#18835 should contain the same thing without the extra bloat. |
@Luap99 @mtrmac I see an update to this package is queued for c/image (will open on Monday). FYI, in case that also needs a bloat-free update and/or closing. |
renovate
bot
changed the title
renovate
bot
deleted the
renovate/go-github.com/sigstore/rekor-vulnerability
branch
github-actions
bot
added
the
locked - please file new issue/PR
This PR contains the following updates:
v1.1.2-0.20230508234306-ad288b385a44->v1.2.0GitHub Vulnerability Alerts
CVE-2023-33199
Impact
A malformed proposed entry of the
intoto/v0.0.2type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.Patches
This is fixed in v1.2.0 of Rekor.
Workarounds
No
References
Discovered by OSS-Fuzz
Configuration
📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.