Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Update docker dep to fix CVE-2024-41110 #1607

Merged
merged 2 commits into from
Aug 15, 2024

Conversation

dcaravel
Copy link
Contributor

@dcaravel dcaravel commented Aug 15, 2024

Updates github.com/docker/docker to address CVE-2024-41110 targeting Scanner 2.33.6 and Stackrox 4.4.5

Expecting scanner version 2.33.6 to contain this change and be used in this backport: stackrox/stackrox#12422

@dcaravel dcaravel requested a review from a team August 15, 2024 20:09
Copy link
Collaborator

@RTann RTann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but something to think about: I'm pretty confident we are not affected by this. I think this just affects the docker engine runtime, which we aren't running/using.

@RTann
Copy link
Collaborator

RTann commented Aug 15, 2024

Also, you may have to rebase? I actually just cherry-picked d4b374d into this branch, and it modified the go.mod/go.sum

@ghost
Copy link

ghost commented Aug 15, 2024

Images are ready for the commit at 20cf1cb.

To use the images, use the tag 2.33.5-4-g20cf1cbbf0.

@dcaravel
Copy link
Contributor Author

dcaravel commented Aug 15, 2024

LGTM, but something to think about: I'm pretty confident we are not affected by this. I think this just affects the docker engine runtime, which we aren't running/using.

Agreed, I'm sure some scanners would report it regardless, this would at least eliminate some future false positives / headaches.

Also, you may have to rebase? I actually just cherry-picked d4b374d into this branch, and it modified the go.mod/go.sum

ACK - right now seems OK but will rebase

@dcaravel dcaravel force-pushed the dc/release-2.33-upd-deps branch from 8337254 to 20cf1cb Compare August 15, 2024 20:15
Copy link

openshift-ci bot commented Aug 15, 2024

@dcaravel: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-tests 20cf1cb link false /test e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@dcaravel
Copy link
Contributor Author

Test failure unrelated to change - tests were fixed in this PR #1567 (has not been backported to this branch)

@dcaravel dcaravel merged commit 5928192 into release-2.33 Aug 15, 2024
23 of 24 checks passed
@dcaravel dcaravel deleted the dc/release-2.33-upd-deps branch August 15, 2024 21:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants