Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CHEF-15132-Updated Libraries having CVEs for upcoming WS release #3283

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

CHEF-15132-Updated Libraries having CVEs for upcoming WS release #3283

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c9670ad
updated libxml2 and libarchive and gems
nikhil2611 Oct 22, 2024
72e3819
added git-windows 2.47.0
nikhil2611 Oct 23, 2024
054334f
fixing the rdoc CVE
nikhil2611 Oct 23, 2024
32eb7b5
fixing the gemfile.lock issues
nikhil2611 Oct 23, 2024
d6446ba
trying to update curl to 8.6.0
nikhil2611 Oct 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions components/gems/Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@ group(:omnibus_package, :development, :test) do
# The version of ruby/openssl that supports the FIPS mode of OpenSSL 3.0/3.1 is 3.2.0
# and later, hence pinning the version for openssl.
gem "openssl", ">= 3.2.0"

gem "rdoc", "~> 6.4.1" # 6.4.1.1 required for CVE-2024-27281, allow patch upgrades
end

group(:dep_selector) do
Expand Down
7 changes: 7 additions & 0 deletions components/gems/Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -967,6 +967,8 @@ GEM
pry-stack_explorer (0.6.1)
binding_of_caller (~> 1.0)
pry (~> 0.13)
psych (5.1.2)
stringio
public_suffix (6.0.1)
r18n-core (5.0.1)
r18n-desktop (5.0.1)
Expand All @@ -990,6 +992,8 @@ GEM
nokogiri (~> 1.12, >= 1.12.5)
optimist (~> 3.0)
rdp-ruby-wmi (0.3.1)
rdoc (6.4.1.1)
psych (>= 4.0.0)
recursive-open-struct (1.1.3)
regexp_parser (2.9.2)
representable (3.2.0)
Expand Down Expand Up @@ -1067,12 +1071,14 @@ GEM
semverse (>= 1.1, < 4.0)
sshkey (2.0.0)
sslshake (1.3.1)
stringio (3.1.1)
strings (0.2.1)
strings-ansi (~> 0.2)
unicode-display_width (>= 1.5, < 3.0)
unicode_utils (~> 1.4)
strings-ansi (0.2.0)
strscan (3.1.0)
structured_warnings (0.4.0)
syslog-logger (1.6.8)
test-kitchen (3.6.0)
bcrypt_pbkdf (~> 1.0)
Expand Down Expand Up @@ -1404,6 +1410,7 @@ DEPENDENCIES
rake (= 13.0.1)
rb-readline
rdp-ruby-wmi
rdoc (~> 6.4.1)
ruby-shadow!
test-kitchen (>= 3.0)
unf_ext (~> 0.0.8.2)
Expand Down
4 changes: 2 additions & 2 deletions omnibus/config/software/openssl.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
dependency "cacerts"
dependency "openssl-fips" if fips_mode?

default_version "3.0.12"
default_version "3.0.15"

# Openssl builds engines as libraries into a special directory. We need to include
# that directory in lib_dirs so omnibus can sign them during macOS deep signing.
Expand All @@ -35,7 +35,7 @@
internal_source url: "#{ENV["ARTIFACTORY_REPO_URL"]}/#{name}/#{name}-#{version}.tar.gz", extract: :lax_tar,
authorization: "X-JFrog-Art-Api:#{ENV["ARTIFACTORY_TOKEN"]}"

version("3.0.12") { source sha256: "f93c9e8edde5e9166119de31755fc87b4aa34863662f67ddfcba14d0b6b69b61" }
version("3.0.15") { source sha256: "23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533" }

relative_path "openssl-#{version}"

Expand Down
8 changes: 4 additions & 4 deletions omnibus_overrides.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,15 @@
override "chef-analyze", version: "0.1.186"
# /DO NOT MODIFY

override "libarchive", version: "3.7.4"
override "libarchive", version: "3.7.5"
override "libffi", version: "3.4.2"
override "libiconv", version: "1.16"
override "liblzma", version: "5.2.5"
override "curl", version: "8.4.0"
override "curl", version: "8.6.0"
override "go", version: "1.22.5"
override "git-windows", version: "2.41.0"
override "git-windows", version: "2.47.0"
override "libyaml", version: "0.1.7"
override "libxml2", version: "2.12.5"
override "libxml2", version: "2.12.7"
override "makedepend", version: "1.0.5"
override "ncurses", version: "6.4"
override :stunnel, version: "5.71"
Expand Down
Loading