reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgraded dependency

Browse Source 
- Details in reweave/CHANGELOG.md
This commit is contained in:
Raj Chaudhuri committed 2024-04-05 20:19:51 +05:30
1 parent ff91a56fc4
commit ac180cfc10
13 files changed
+135 -125
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

go.mod
+1 -1
View File
@@ -10,7 +10,7 @@ require (
github.com/containernetworking/cni v1.1.2
github.com/containernetworking/plugins v1.2.0
github.com/coreos/go-iptables v0.6.0
github.com/docker/docker v24.0.7+incompatible
github.com/docker/docker v24.0.9+incompatible
github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b
github.com/docker/machine v0.14.0
github.com/fsouza/go-dockerclient v1.10.0
go.sum
+2 -2
View File
@@ -85,8 +85,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/docker/distribution v2.8.2-beta.1+incompatible h1:gILO60VLD2v28ozemv4aAwDb8ds5U2O/vD/sBXbd7Rw=
github.com/docker/distribution v2.8.2-beta.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/docker v24.0.9+incompatible h1:HPGzNmwfLZWdxHqK9/II92pyi1EpYKsAqcl4G0Of9v0=
github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
reweave/CHANGELOG.md
+9 -1
View File
@@ -2,7 +2,15 @@
All changes made to the weave net codebase during the reweave effort will be documented in this file.
## 2.8.4
## 2.8.5-beta1
### Changed
* Upgraded github.com/docker/docker to 24.0.9+incompatible
* Ran `go mod vendor`
* Modified `reweave/build/Dockerfile`, to cater for timeouts and other errors during `apt` operations
## 2.8.4 (c3afe552)
### Changed
reweave/Makefile
+1 -1
View File
@@ -1,4 +1,4 @@
IMAGE_VERSION ?= 2.8.4
IMAGE_VERSION ?= 2.8.5-beta1
REGISTRY_USER ?= rajchaudhuri
ALPINE_BASEIMAGE ?= alpine:3.19.1
reweave/build/Dockerfile
+5 -2
View File
@@ -7,7 +7,7 @@ ARG ALPINE_BASEIMAGE=alpine:3.19.1
# It will be built only once for a given build platform. Subsequent
# stages will start from this and cross-compile for each target
# architecture.
FROM --platform=${BUILDPLATFORM} golang:1.21.6-bullseye AS builderbase
FROM --platform=${BUILDPLATFORM} golang:1.21.9-bullseye AS builderbase
# Support Raspberry Pi 2 and newer
ENV GOARM 7
@@ -23,8 +23,11 @@ ENV DEB_CROSSPLATFORMS \
# Install the build-essential and crossbuild-essential-ARCH packages
RUN <<EOCROSSCOMPILERS
set -e
echo 'Acquire::Retries "6";' > /etc/apt/apt.conf.d/80-retries
for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done
apt-get update
apt-get update --error-on=any
apt-get upgrade -y
apt-get install -y build-essential
for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done
apt-get clean
reweave/scans/badge.json
+1 -1
View File
@@ -1 +1 @@
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "24", "color": "orange"}
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "17", "color": "orange"}
reweave/scans/report.md
+74 -100
View File
@@ -1,9 +1,9 @@
# Vulnerability Report
```
Report date: 2024-03-30
Unique vulnerability count: 24
Images version: 2.8.4
Report date: 2024-04-04
Unique vulnerability count: 17
Images version: 2.8.5-beta1
```
## Scanner Details
@@ -23,116 +23,90 @@ Supported DB Schema: 5
## Vulnerabilities
### weave-kube: (24)
### weave-kube: (17)
```
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
```
### weave-npc: (17)
### weave-npc: (12)
```
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
```
### weave: (24)
### weave: (17)
```
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
```
### weaveexec: (24)
### weaveexec: (17)
```
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
c-ares 1.24.0-r1 1.27.0-r0 apk CVE-2024-25629 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
github.com/docker/docker v24.0.7+incompatible 24.0.9 go-module GHSA-xw73-rw38-6vjc Medium
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
stdlib go1.21.6 go-module CVE-2024-24785 Unknown
stdlib go1.21.6 go-module CVE-2024-24784 Unknown
stdlib go1.21.6 go-module CVE-2024-24783 Unknown
stdlib go1.21.6 go-module CVE-2023-45290 Unknown
stdlib go1.21.6 go-module CVE-2023-45289 Unknown
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
curl 8.5.0-r0 apk CVE-2024-0853 Medium
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
libuv 1.47.0-r0 apk CVE-2024-24806 High
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
```
vendor/github.com/docker/docker/api/swagger.yaml
Generated Vendored
+1 -3
View File
@@ -3011,8 +3011,6 @@ definitions:
Name: "journald"
- Type: "Log"
Name: "json-file"
- Type: "Log"
Name: "logentries"
- Type: "Log"
Name: "splunk"
- Type: "Log"
@@ -5334,7 +5332,7 @@ definitions:
type: "array"
items:
type: "string"
example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "logentries", "splunk", "syslog"]
example: ["awslogs", "fluentd", "gcplogs", "gelf", "journald", "json-file", "splunk", "syslog"]
RegistryServiceConfig:
vendor/github.com/docker/docker/client/container_wait.go
Generated Vendored
+6 -2
View File
@@ -66,8 +66,12 @@ func (cli *Client) ContainerWait(ctx context.Context, containerID string, condit
//
// If there's a JSON parsing error, read the real error message
// off the body and send it to the client.
_, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit))
errC <- errors.New(responseText.String())
if errors.As(err, new(*json.SyntaxError)) {
_, _ = io.ReadAll(io.LimitReader(stream, containerWaitErrorMsgLimit))
errC <- errors.New(responseText.String())
} else {
errC <- err
}
return
}
vendor/github.com/docker/docker/pkg/idtools/idtools_unix.go
Generated Vendored
+4 -10
View File
@@ -11,17 +11,11 @@ import (
"os/exec"
"path/filepath"
"strconv"
"sync"
"syscall"
"github.com/opencontainers/runc/libcontainer/user"
)
var (
entOnce sync.Once
getentCmd string
)
func mkdirAs(path string, mode os.FileMode, owner Identity, mkAll, chownExisting bool) error {
path, err := filepath.Abs(path)
if err != nil {
@@ -162,10 +156,10 @@ func getentGroup(name string) (user.Group, error) {
}
func callGetent(database, key string) (io.Reader, error) {
entOnce.Do(func() { getentCmd, _ = resolveBinary("getent") })
// if no `getent` command on host, can't do anything else
if getentCmd == "" {
return nil, fmt.Errorf("unable to find getent command")
getentCmd, err := resolveBinary("getent")
// if no `getent` command within the execution environment, can't do anything else
if err != nil {
return nil, fmt.Errorf("unable to find getent command: %w", err)
}
command := exec.Command(getentCmd, database, key)
// we run getent within container filesystem, but without /dev so /dev/null is not available for exec to mock stdin
vendor/github.com/docker/docker/pkg/ioutils/readers.go
Generated Vendored
+21
View File
@@ -3,11 +3,15 @@ package ioutils // import "github.com/docker/docker/pkg/ioutils"
import (
"context"
"io"
"runtime/debug"
"sync/atomic"
// make sure crypto.SHA256, crypto.sha512 and crypto.SHA384 are registered
// TODO remove once https://github.com/opencontainers/go-digest/pull/64 is merged.
_ "crypto/sha256"
_ "crypto/sha512"
"github.com/sirupsen/logrus"
)
// ReadCloserWrapper wraps an io.Reader, and implements an io.ReadCloser
@@ -16,10 +20,15 @@ import (
type ReadCloserWrapper struct {
io.Reader
closer func() error
closed atomic.Bool
}
// Close calls back the passed closer function
func (r *ReadCloserWrapper) Close() error {
if !r.closed.CompareAndSwap(false, true) {
subsequentCloseWarn("ReadCloserWrapper")
return nil
}
return r.closer()
}
@@ -87,6 +96,7 @@ type cancelReadCloser struct {
cancel func()
pR *io.PipeReader // Stream to read from
pW *io.PipeWriter
closed atomic.Bool
}
// NewCancelReadCloser creates a wrapper that closes the ReadCloser when the
@@ -146,6 +156,17 @@ func (p *cancelReadCloser) closeWithError(err error) {
// Close closes the wrapper its underlying reader. It will cause
// future calls to Read to return io.EOF.
func (p *cancelReadCloser) Close() error {
if !p.closed.CompareAndSwap(false, true) {
subsequentCloseWarn("cancelReadCloser")
return nil
}
p.closeWithError(io.EOF)
return nil
}
func subsequentCloseWarn(name string) {
logrus.Error("subsequent attempt to close " + name)
if logrus.GetLevel() >= logrus.DebugLevel {
logrus.Errorf("stack trace: %s", string(debug.Stack()))
}
}
vendor/github.com/docker/docker/pkg/ioutils/writers.go
Generated Vendored
+9 -1
View File
@@ -1,6 +1,9 @@
package ioutils // import "github.com/docker/docker/pkg/ioutils"
import "io"
import (
"io"
"sync/atomic"
)
// NopWriter represents a type which write operation is nop.
type NopWriter struct{}
@@ -29,9 +32,14 @@ func (f *NopFlusher) Flush() {}
type writeCloserWrapper struct {
io.Writer
closer func() error
closed atomic.Bool
}
func (r *writeCloserWrapper) Close() error {
if !r.closed.CompareAndSwap(false, true) {
subsequentCloseWarn("WriteCloserWrapper")
return nil
}
return r.closer()
}
vendor/modules.txt
Vendored
+1 -1
View File
@@ -95,7 +95,7 @@ github.com/davecgh/go-spew/spew
## explicit
github.com/docker/distribution/digestset
github.com/docker/distribution/reference
# github.com/docker/docker v24.0.7+incompatible
# github.com/docker/docker v24.0.9+incompatible
## explicit
github.com/docker/docker/api
github.com/docker/docker/api/types