Merged
Conversation
This edge release updates the proxy's dependency on the `rustls` library to patch security vulnerability [RUSTSEC-2023-0052] (GHSA-8qv2-5vq6-g2g7), a potential CPU usage denial-of-service attack when acceting a TLS handshake from an untrusted peer with a maliciously-crafted certificate. Furthermore, this edge release contains a few improvements to the control plane and jaeger extension Helm charts. * Addressed security vulnerability [RUSTSEC-2023-0052] in the proxy by updating its dependency on the `rustls` library * Added a `prometheusUrl` field for the heartbeat job in the control plane Helm chart (thanks @david972!) ([#11343]; fixes [#11342]) * Introduced support for arbitrary labels in the `podMonitors` field in the control plane Helm chart (thanks @jseiser!) ([#11222]; fixes [#11175]) * Added support for config merge and Deployment environment to `opentelemetry-collector` in the jaeger extension (thanks @iAnomaly!) ([#11283]) [#11283]: #11283 [#11222]: #11222 [#11175]: #11175 [#11343]: #11343 [#11342]: #11342 Signed-off-by: Matei David <[email protected]>
alpeb
approved these changes
Sep 22, 2023
adleong
approved these changes
Sep 22, 2023
hawkw
suggested changes
Sep 22, 2023
Contributor
hawkw
left a comment
hawkw
left a comment
There was a problem hiding this comment.
the links to the RUSTSEC advisory are missing a link reference. let's fix that before publishing.
Signed-off-by: Matei David <[email protected]>
Signed-off-by: Matei David <[email protected]>
hawkw
approved these changes
Sep 22, 2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This edge release updates the proxy's dependency on the
rustlslibrary topatch security vulnerability RUSTSEC-2023-0052
(GHSA-8qv2-5vq6-g2g7), a potential CPU usage denial-of-service attack when
acceting a TLS handshake from an untrusted peer with a maliciously-crafted
certificate. Furthermore, this edge release contains a few improvements to the
control plane and jaeger extension Helm charts.
the proxy by updating its dependency on the
rustlslibraryprometheusUrlfield for the heartbeat job in the control plane Helmchart (thanks @david972!) (#11343; fixes #11342)
podMonitorsfield in thecontrol plane Helm chart (thanks @jseiser!) (#11222; fixes #11175)
opentelemetry-collectorin the jaeger extension (thanks @iAnomaly!)(#11283)