Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

trivy: Ignore CVE-2024-26147 (helm) #9217

Closed
wants to merge 1 commit into from
Closed

trivy: Ignore CVE-2024-26147 (helm) #9217

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,12 @@ CVE-2022-41721
# This CVE has not yet been patched in the kubectl version we are using, however it should not
# affect us as kubernetes does not use the affected code path (see description in
# https://github.com/kubernetes/kubernetes/pull/118036).
CVE-2023-2253
CVE-2023-2253

# These CVEs only impacts install of Gloo-Edge from Glooctl CLI.
# It only leads to a panic if there is a misconfigured / malicious helm plugin installed
# and can be easily resolved by removing the misconfigured / malicious plugin
# The helm bump will require bumping the k8s dependencies by +2 minor versions that can cause issues.
# https://github.com/solo-io/gloo/issues/9186
# https://github.com/advisories/GHSA-r53h-jv2g-vpx6
CVE-2024-26147
8 changes: 8 additions & 0 deletions changelog/v1.14.30/ignore-helm-114.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
changelog:
- type: NON_USER_FACING
issueLink: https://github.com/solo-io/gloo/issues/9187
resolvesIssue: true
description: >
Choosing to ignore helm upgrade, as it does not impact the data and control planes of Gloo Edge. This only impacts glooctl and panics will not affect future uses of glooclt. The fix to bump helm will also require bumping the k8s dependencies by several minor versions that can cause issues. As it also has a simple resolution on the client side, it is therefore deemed to have little to no impact.
skipCI-kube-tests:true
skipCI-docs-build:true
Loading