Skip to content

kubernetes module version 11.0.0 has CVE #1251

@goern

Description

@goern

Is your feature request related to a problem? Please describe.
https://github.com/thoth-station/common/blob/master/requirements.txt#L10 declares a dependency on kubernetes, current versions v11.0.0 is affected by https://access.redhat.com/security/cve/cve-2020-1747

This results in all our container images having a critical security issue, for example: https://quay.io/repository/thoth-station/integration-tests/manifest/sha256:7d4195a824800c12b63b011e29f2f1ffc7e623a3753373cd5c2c5c775b3ac7df?tab=vulnerabilities

Describe the solution you'd like
update kubernetes dependency to new version, release new patch version of thoth-common

Describe alternatives you've considered
n/a

Additional context

Update to v12.0.0 can be done,
due to the issue #1273
wait for a better release and testing.

Acceptance criteria

  • kubernetes package is up to date in the common repo
  • verify the kube config is loading
  • dependent images are updated
  • dependent packages work. Ex: user-api, management-api
  • quay not showing critical cve on current versions of thoth-station images

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/bugCategorizes issue or PR as related to a bug.lifecycle/frozenIndicates that an issue or PR should not be auto-closed due to staleness.priority/critical-urgentHighest priority. Must be actively worked on as someone's top priority right now.sig/devsecopsCategorizes an issue or PR as relevant to SIG DevSecOps.triage/acceptedIndicates an issue or PR is ready to be actively worked on.

    Type

    No type

    Projects

    Status

    🔖 Next

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions