New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency rancher/rke2 to v1.29.3+rke2r1 #3790
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Auto-approved because label type/renovate is present.
🔍 Vulnerabilities of
|
digest | sha256:4dbf1be198b04ee921da5f6ce80a2ab1a165fc2c49e4eab663595b6fc5c58681 |
vulnerabilities | |
platform | linux/amd64 |
size | 35 MB |
packages | 316 |
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
|
Affected range | <0.44.0 |
Fixed version | 0.44.0 |
CVSS Score | 7.5 |
CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Description
Summary
This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65
out of the box adds labels
http.user_agent
http.method
that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it.
Details
HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent.
PoC
Send many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it.
Impact
In order to be affected, the program has to configure a metrics pipeline, use otelhttp.NewHandler wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.
Others
It is similar to already reported vulnerabilities
- GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
- GHSA-cg3q-j54f-5p7p (prometheus/client_golang)
Workaround for affected versions
As a workaround to stop being affected otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely.
For convenience and safe usage of this library, it should by default mark with the label
unknown
non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.The other possibility is to disable HTTP metrics instrumentation by passing
otelhttp.WithMeterProvider
option withnoop.NewMeterProvider
.Solution provided by upgrading
In PR open-telemetry/opentelemetry-go-contrib#4277, released with package version 0.44.0, the values collected for attribute
http.request.method
were changed to be restricted to a set of well-known values and other high cardinality attributes were removed.References
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.35.0
(golang)
pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.35.0
Allocation of Resources Without Limits or Throttling
Affected range | <0.46.0 |
Fixed version | 0.46.0 |
CVSS Score | 7.5 |
CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Description
Summary
The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go
// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {
out of the box adds labels
net.peer.sock.addr
net.peer.sock.port
that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.
Details
An attacker can easily flood the peer address and port for requests.
PoC
Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.
Impact
In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.
Others
It is similar to already reported vulnerabilities.
- GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
- GHSA-cg3q-j54f-5p7p (prometheus/client_golang)
Workaround for affected versions
As a workaround to stop being affected, a view removing the attributes can be used.
The other possibility is to disable grpc metrics instrumentation by passing
otelgrpc.WithMeterProvider
option withnoop.NewMeterProvider
.Solution provided by upgrading
In PR #4322, to be released with v0.46.0, the attributes were removed.
References
github.com/jackc/pgx/v5 5.4.2
(golang)
pkg:golang/github.com/jackc/pgx/v5@5.4.2
Integer Overflow or Wraparound
Affected range | >=5.0.0 |
Fixed version | 5.5.4 |
Description
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v2.3.3
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
Integer Overflow or Wraparound
Affected range | >=5.0.0 |
Fixed version | 5.5.4 |
Description
Impact
SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.
Patches
The problem is resolved in v4.18.2 and v5.5.4.
Workarounds
Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
github.com/docker/docker 24.0.0-rc.2.0.20230801142700-69c9adb7d386+incompatible
(golang)
pkg:golang/github.com/docker/docker@24.0.0-rc.2.0.20230801142700-69c9adb7d386+incompatible
Insufficient Verification of Data Authenticity
Affected range | <24.0.9 |
Fixed version | 24.0.9 |
CVSS Score | 6.9 |
CVSS Vector | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L |
Description
The classic builder cache system is prone to cache poisoning if the image is built
FROM scratch
.
Also, changes to some instructions (most important beingHEALTHCHECK
andONBUILD
) would not cause a cache miss.An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.
For example, an attacker could create an image that is considered as a valid cache candidate for:
FROM scratch MAINTAINER Pawel
when in fact the malicious image used as a cache would be an image built from a different Dockerfile.
In the second case, the attacker could for example substitute a different
HEALTCHECK
command.Impact
23.0+ users are only affected if they explicitly opted out of Buildkit (
DOCKER_BUILDKIT=0
environment variable) or are using the/build
API endpoint (which uses the classic builder by default).All users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.
Image build API endpoint (
/build
) andImageBuild
function fromgithub.com/docker/docker/client
is also affected as it the uses classic builder by default.Patches
Patches are included in Moby releases:
- v25.0.2
- v24.0.9
Workarounds
- Use
--no-cache
or use Buildkit if possible (DOCKER_BUILDKIT=1
, it's default on 23.0+ assuming that the buildx plugin is installed).- Use
Version = types.BuilderBuildKit
orNoCache = true
inImageBuildOptions
forImageBuild
call.
google.golang.org/protobuf 1.32.0
(golang)
pkg:golang/google.golang.org/protobuf@1.32.0
Loop with Unreachable Exit Condition ('Infinite Loop')
Affected range | <1.33.0 |
Fixed version | 1.33.0 |
Description
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/8398394187. |
PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/8398394187. |
This PR contains the following updates:
1.29.2+rke2r1
->1.29.3+rke2r1
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
rancher/rke2 (rancher/rke2)
v1.29.3+rke2r1
: v1.29.3+rke2r1Compare Source
This release updates Kubernetes to v1.29.2.
Important Notes
Canal uses flannel 0.24.3 which includes a bug: every 5 seconds it tries to add ipv6 iptables rules and fails if the node does not have an ipv6 address. The consequence is the log "Failed to ensure iptables rules: error setting up rules: failed to apply partial iptables-restore unable to run iptables-restore (, ): exit status 4" appears every 5 seconds in the flannel container of the canal pod.
Flannel daemonset is not tolerating node taints: "node-role.kubernetes.io/etcd:NoExecute", "node-role.kubernetes.io/control-plane:NoSchedule" and "node.cloudprovider.kubernetes.io/uninitialized:NoSchedule" which can create problems when deploying with Rancher in certain cloud-providers (e.g. vShpere or DigitalOcean).
If your server (control-plane) nodes were not started with the
--token
CLI flag or config file key, a randomized token was generated during initial cluster startup. This key is used both for joining new nodes to the cluster, and for encrypting cluster bootstrap data within the datastore. Ensure that you retain a copy of this token, as is required when restoring from backup.You may retrieve the token value from any server already joined to the cluster:
Changes since v1.29.1+rke2r1:
containerd
behavior for Windows Agents, ensure supporting processes exit (#5419)Charts Versions
Packaged Component Versions
Available CNIs
Calico v3.27.0
Helpful Links
As always, we welcome and appreciate feedback from our community of users. Please feel free to:
v1.29.3-rc2+rke2r1
: v1.29.3-rc2+rke2r1Compare Source
v1.29.3-rc1+rke2r1
: v1.29.3-rc1+rke2r1Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.