Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Upgrade kubectl to v1.24.8 to fix vulnerabilities #10008

Merged
merged 2 commits into from Nov 14, 2022

Conversation

terrytangyuan
Copy link
Member

@terrytangyuan terrytangyuan commented Nov 10, 2022

Signed-off-by: Yuan Tang terrytangyuan@gmail.com

Fixes #10006

We are taking one minor version less than v1.25.3 (based on https://storage.googleapis.com/kubernetes-release/release/stable.txt)
which is v1.24 and v1.24.5 contains the security fixes.

Reference: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#important-security-information

Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
Copy link
Member

@tczhao tczhao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should just use the latest 1.24 (i.e. 1.24.8)
There has been other security patch since 1.24.5

Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
@terrytangyuan
Copy link
Member Author

Good idea. Updated.

@terrytangyuan terrytangyuan changed the title fix: Upgrade kubectl to v1.24.5 to fix vulnerabilities fix: Upgrade kubectl to v1.24.8 to fix vulnerabilities Nov 12, 2022
@terrytangyuan terrytangyuan merged commit 4eb6cb7 into argoproj:master Nov 14, 2022
@terrytangyuan terrytangyuan deleted the update-kubectl branch November 14, 2022 16:35
sarabala1979 pushed a commit that referenced this pull request Nov 29, 2022
Signed-off-by: Yuan Tang <terrytangyuan@gmail.com>
Signed-off-by: Saravanan Balasubramanian <sarabala1979@gmail.com>
@agilgur5 agilgur5 added type/security Security related type/dependencies PRs and issues specific to updating dependencies labels Oct 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/dependencies PRs and issues specific to updating dependencies type/security Security related
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2022-3172 and CVE-2021-25740
6 participants