[release-1.14] Bump c/image v5.29.3, c/common v0.57.5, CVE-2024-3727 #2331
Conversation
Bump c/image to v5.29.3 and c/common to v0.57.3 Addresses: CVE-2024-3727 https://issues.redhat.com/browse/RHEL-35914 and RHEL 8.10/9.4 cards once they are spun up. Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
Bumps Skopeo to v1.14.4 to incorporate the fix for CVE-2024-3727 Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
|
I just realized I never made a v1.14.3 release, will do so now. |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
There was a problem hiding this comment.
@TomSweeneyRedHat The version bumps LGTM, but the “Bump Skopeo to v1.14.4” commit only updates go.sum.
There was a problem hiding this comment.
@TomSweeneyRedHat just wondering, could this have been 1.14.3?
|
@TomSweeneyRedHat This is now a strict subset of #2337, so I think this PR can be closed in favor of the other one — but the two refer to different Jira bugs, I’m not sure if anything needs updating Jira-side. |
|
I messed this one up entirely. The Jira card this was meant to tend to is https://issues.redhat.com/browse/RHEL-35443. That was fixed by a renovate PR in upstream with #2334. We still need a change in the release-1.14 branch, we will continue on with that with #2337, which is in a happier state. |
Bump c/image to v5.29.3 and c/common to v0.57.3, and then Skopeo to v1.14.4
Addresses: CVE-2024-3727
https://issues.redhat.com/browse/RHEL-35914
and RHEL 8.10/9.4 cards once they are spun up.