CVE-2024-12698: ose-olm-catalogd-container: incomplete fix for rapid reset (CVE-2023-39325/CVE-2023-44487) [openshift-4.19] #102
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: camilamacedo86 The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
This should really be done upstream, and then properly downstreamed, since you are making changes to non-openshift code. |
|
This commit may not be necessary once the latest downstreaming happens... so let's wait until #104 merges |
openshift-ci
bot
added
the
do-not-merge/hold
… Risks (#484) Ensure HTTP/2 is disabled by default for webhooks. Disabling HTTP/2 mitigates vulnerabilities associated with: - HTTP/2 Stream Cancellation (GHSA-qppj-fm5r-hxr3) - HTTP/2 Rapid Reset (GHSA-4374-p667-p6c8) While CVE fixes exist, they remain insufficient; disabling HTTP/2 helps reduce risks. For details, see: kubernetes/kubernetes#121197 Signed-off-by: Camila Macedo <7708031+camilamacedo86@users.noreply.github.com>
Signed-off-by: Camila Macedo <7708031+camilamacedo86@users.noreply.github.com>
camilamacedo86
force-pushed
the
fix-http-cve-4.19
branch
from
f9a6e32 to
475ea9c
Compare
camilamacedo86
changed the title
|
@camilamacedo86: No Jira issue with key CVE-2024 exists in the tracker at https://issues.redhat.com/. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@camilamacedo86: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
It is synced in this branch now, see: https://github.com/openshift/operator-framework-catalogd/blob/release-4.19/cmd/manager/main.go#L172-L189 We do not need this PR |
Cheery pick from https://github.com/operator-framework/catalogd