Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module github.com/sigstore/rekor to v1.2.0 [SECURITY] - autoclosed #18833

Closed

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 9, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/sigstore/rekor indirect minor v1.1.2-0.20230508234306-ad288b385a44 -> v1.2.0

GitHub Vulnerability Alerts

CVE-2023-33199

Impact

A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

Patches

This is fixed in v1.2.0 of Rekor.

Workarounds

No

References

Discovered by OSS-Fuzz


Configuration

📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot added dependencies Pull requests that update a dependency file release-note-none security labels Jun 9, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 9, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign jwhonce for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cevich
Copy link
Member

cevich commented Jun 9, 2023

In the dependabot PR (closed) Miloslav said the size-increase is expected.

Edit: Miloslav also said the impact/affect of the CVE on podman isn't great. So I don't think there's any rush to merge this.

@cevich cevich added the bloat_approved Approve a PR in which binary file size grows by over 50k label Jun 9, 2023
@Luap99
Copy link
Member

Luap99 commented Jun 9, 2023

#18835 should contain the same thing without the extra bloat.

@cevich
Copy link
Member

cevich commented Jun 9, 2023

#18835 should contain the same thing without the extra bloat.

@Luap99 @mtrmac I see an update to this package is queued for c/image (will open on Monday). FYI, in case that also needs a bloat-free update and/or closing.

@renovate renovate bot changed the title Update module github.com/sigstore/rekor to v1.2.0 [SECURITY] Update module github.com/sigstore/rekor to v1.2.0 [SECURITY] - autoclosed Jun 12, 2023
@renovate renovate bot closed this Jun 12, 2023
@renovate renovate bot deleted the renovate/go-github.com/sigstore/rekor-vulnerability branch June 12, 2023 12:36
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 11, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 11, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bloat_approved Approve a PR in which binary file size grows by over 50k dependencies Pull requests that update a dependency file locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. release-note-none security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants