Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Raj Chaudhuri
|
b0477a25ff | ||
|
Raj Chaudhuri
|
81117751ca | ||
|
Raj Chaudhuri
|
8cfc740455 |
No files matched your search
@@ -1,3 +1,7 @@
|
||||
## Release 2.8.8
|
||||
|
||||
The alpine base image used by `weave-kube` and `weave-npc` has been upgraded to version 3.20.0 in this release. This removes several CVEs.
|
||||
|
||||
## Release 2.8.7
|
||||
|
||||
This release has upgraded dependencies based on CVE recommendations.
|
||||
|
||||
@@ -2,6 +2,17 @@
|
||||
|
||||
All changes made to the weave net codebase during the reweave effort will be documented in this file.
|
||||
|
||||
## 2.8.8
|
||||
|
||||
* Changed version in `reweave/Makefile` to 2.8.8
|
||||
* Modified reweave and main CHANGELOG.md
|
||||
|
||||
## 2.8.8-beta1
|
||||
|
||||
### Changed
|
||||
|
||||
* Alpine base image upgraded to alpine:3.20.0 in `reweave/Makefile`
|
||||
|
||||
## 2.8.7
|
||||
|
||||
### Changed
|
||||
|
||||
+2
-2
@@ -1,7 +1,7 @@
|
||||
IMAGE_VERSION ?= 2.8.7
|
||||
IMAGE_VERSION ?= 2.8.8
|
||||
REGISTRY_USER ?= rajchaudhuri
|
||||
|
||||
ALPINE_BASEIMAGE ?= alpine:3.19.1
|
||||
ALPINE_BASEIMAGE ?= alpine:3.20.0
|
||||
|
||||
# Targets
|
||||
.PHONY: build-images
|
||||
|
||||
@@ -1 +1 @@
|
||||
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "18", "color": "orange"}
|
||||
{"schemaVersion": 1, "label": "Vulnerabilty count", "message": "3", "color": "orange"}
|
||||
+29
-83
@@ -1,115 +1,61 @@
|
||||
# Vulnerability Report
|
||||
|
||||
```
|
||||
Report date: 2024-05-05
|
||||
Unique vulnerability count: 18
|
||||
Images version: 2.8.7
|
||||
Report date: 2024-06-19
|
||||
Unique vulnerability count: 3
|
||||
Images version: 2.8.8
|
||||
```
|
||||
|
||||
## Scanner Details
|
||||
|
||||
```
|
||||
Application: grype
|
||||
Version: 0.77.2
|
||||
BuildDate: 2024-05-01T16:20:45Z
|
||||
GitCommit: bd16101ad0ed30c38e95d0992d0ad53f709dc5df
|
||||
GitDescription: v0.77.2
|
||||
Version: 0.79.1
|
||||
BuildDate: 2024-06-17T19:33:32Z
|
||||
GitCommit: 239741f535c59d6e1b9faee61f64ebcf4361d2c5
|
||||
GitDescription: v0.79.1
|
||||
Platform: linux/amd64
|
||||
GoVersion: go1.21.9
|
||||
GoVersion: go1.22.4
|
||||
Compiler: gc
|
||||
Syft Version: v1.3.0
|
||||
Syft Version: v1.7.0
|
||||
Supported DB Schema: 5
|
||||
```
|
||||
|
||||
## Vulnerabilities
|
||||
|
||||
### weave-kube: (18)
|
||||
### weave-kube: (3)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
stdlib go1.21.9 go-module CVE-2024-24790 Critical
|
||||
stdlib go1.21.9 go-module CVE-2024-24789 Medium
|
||||
stdlib go1.21.9 go-module CVE-2024-24787 Unknown
|
||||
```
|
||||
|
||||
### weave-npc: (12)
|
||||
### weave-npc: (3)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
stdlib go1.21.9 go-module CVE-2024-24790 Critical
|
||||
stdlib go1.21.9 go-module CVE-2024-24789 Medium
|
||||
stdlib go1.21.9 go-module CVE-2024-24787 Unknown
|
||||
```
|
||||
|
||||
### weave: (18)
|
||||
### weave: (3)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
stdlib go1.21.9 go-module CVE-2024-24790 Critical
|
||||
stdlib go1.21.9 go-module CVE-2024-24789 Medium
|
||||
stdlib go1.21.9 go-module CVE-2024-24787 Unknown
|
||||
```
|
||||
|
||||
### weaveexec: (18)
|
||||
### weaveexec: (3)
|
||||
|
||||
```
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
busybox 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
busybox-binsh 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-0853 Medium
|
||||
curl 8.5.0-r0 apk CVE-2024-2466 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2398 Unknown
|
||||
curl 8.5.0-r0 apk CVE-2024-2004 Unknown
|
||||
libuv 1.47.0-r0 apk CVE-2024-24806 High
|
||||
nghttp2-libs 1.58.0-r0 apk CVE-2024-28182 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42366 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42365 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42364 Medium
|
||||
ssl_client 1.36.1-r15 apk CVE-2023-42363 Medium
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
stdlib go1.21.9 go-module CVE-2024-24790 Critical
|
||||
stdlib go1.21.9 go-module CVE-2024-24789 Medium
|
||||
stdlib go1.21.9 go-module CVE-2024-24787 Unknown
|
||||
```
|
||||
|
||||
Reference in new issue
Block a user