Skip to content

Q2 2024 zed security patch #1072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 15, 2024
Merged

Q2 2024 zed security patch #1072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
689e533
Bump horizon to fix CVE-2023-31047
seunghun1ee May 14, 2024
9c8439f
Bump grafana to fix CVE-2023-49569
seunghun1ee May 14, 2024
249e60b
Bump prometheus-msteams to fix CVE-2021-4238 and CVE-2022-40083
seunghun1ee May 14, 2024
08e9d23
Add releasenote for q2 2024 security patch for zed
seunghun1ee May 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions etc/kayobe/kolla-image-tags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,21 @@ kolla_image_tags:
cloudkitty:
rocky-9: zed-rocky-9-20240503T150113
ubuntu-jammy: zed-ubuntu-jammy-20240503T150113
grafana:
rocky-9: zed-rocky-9-20240514T095142
ubuntu-jammy: zed-ubuntu-jammy-20240514T092357
heat:
rocky-9: zed-rocky-9-20240320T113114
ubuntu-jammy: zed-ubuntu-jammy-20240320T113114
horizon:
rocky-9: zed-rocky-9-20240514T095142
ubuntu-jammy: zed-ubuntu-jammy-20240514T092357
magnum:
rocky-9: zed-rocky-9-20240301T100039
ubuntu-jammy: zed-ubuntu-jammy-20240301T100039
neutron:
rocky-9: zed-rocky-9-20240202T141530
ubuntu-jammy: zed-ubuntu-jammy-20240202T143208
prometheus:
rocky-9: zed-rocky-9-20240514T095142
ubuntu-jammy: zed-ubuntu-jammy-20240514T092357
6 changes: 6 additions & 0 deletions etc/kayobe/kolla.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -333,6 +333,12 @@ kolla_build_blocks:
{% set magnum_capi_packages = ['git+https://github.com/stackhpc/[email protected]'] %}
RUN {{ macros.install_pip(magnum_capi_packages | customizable("pip_packages")) }}
{% endraw %}
prometheus_msteams_repository_version: | # Zed kolla has 1.5.1
{% raw %}
ARG prometheus_msteams_version=1.5.2
ARG prometheus_msteams_sha256sum=0f4df9ee31e655d1ec876ea2c53ab5ae5b07143ef21b9190e61b4d52839e135c
ARG prometheus_msteams_url=https://github.com/prometheus-msteams/prometheus-msteams/releases/download/v${prometheus_msteams_version}/prometheus-msteams-linux-{{debian_arch}}
{% endraw %}
# Dict mapping image customization variable names to their values.
# Each variable takes the form:
# <image name>_<customization>_<operation>
Expand Down
12 changes: 12 additions & 0 deletions ...notes/notes/zed-bump-horizon-grafana-prometheus-to-fix-critical-cve-4ebd80b4eb5336c7.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
features:
- |
Bumped Horizon kolla image
Bumped Grafana from 10.1.5-1 to 10.4.2-1 (Rocky Linux)
Bumped Grafana from 10.4.1 to 10.4.2 (Ubuntu)
Bumped Prometheus-msteams from 1.5.1 to 1.5.2
security:
- |
Fixed CVE-2023-31047 for Horizon.
Fixed CVE-2023-49569 for Grafana.
Fixed CVE-2022-40083 and CVE-2021-4238 for Prometheus-msteams.
Loading