chore(deps): address CVE-2023-39325, CVE-2023-47108 and GHSA-m425-mq9…

[cmontemuino]

Upgrade images to fix the following vulnerabilities:

• https://avd.aquasec.com/nvd/2023/cve-2023-47108/
• https://avd.aquasec.com/nvd/2023/cve-2023-39325/
• GHSA-m425-mq94-257g

Description

CVE-2023-47108 and CVE-2023-39325 fixed in v2.10.0 from node-driver-registar

GHSA-m425-mq94-257g fixed in v2.10.0 from node-driver-registar, and v6.3.3 from csi-snapshotter (and controller) images.

Motivation and Context

Have no HIGH vulnerabilities in mayastor-extensions

Regression

No
--- see how your change affects other areas of the code, etc. -->

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added unit tests to cover my changes.
  • It not applicable to this changeset

[cmontemuino]

This other PR is blocking #402

• csi-node-driver-registrar v2.10.0 has not been published yet

[tiagolobocastro]

This other PR is blocking #402

* csi-node-driver-registrar v2.10.0 has not been published yet

The release seems to be there though? https://github.com/kubernetes-csi/node-driver-registrar/releases/tag/v2.10.0

[cmontemuino]

This other PR is blocking #402

* csi-node-driver-registrar v2.10.0 has not been published yet

The release seems to be there though? https://github.com/kubernetes-csi/node-driver-registrar/releases/tag/v2.10.0

Yes, the release is there, but the image has not been published. AFAIK that's done in a different repo (basically the one I've created that other PR).

[tiagolobocastro]

Yes, the release is there, but the image has not been published. AFAIK that's done in a different repo (basically the one I've created that other PR).

Ah, which other PR?

[cmontemuino]

Yes, the release is there, but the image has not been published. AFAIK that's done in a different repo (basically the one I've created that other PR).

Ah, which other PR?

Apologies! I was pasting the wrong PR link 🤦 : kubernetes/k8s.io#6256

[tiagolobocastro]

Apologies! I was pasting the wrong PR link 🤦 : kubernetes/k8s.io#6256

no worries, it happens :)
Got it, cool! I've added a blocking label here to prevent this from getting merged, please remove the label or ping us once 2.10 is merged. Thanks!

[cmontemuino]

@tiagolobocastro csi-node-driver-registrar v2.10.0 image is available already.
It's ok to proceed with this PR.

[tiagolobocastro]

@niladrih @Abhinandan-Purkait can we get a review here? thanks

[tiagolobocastro]

bors merge

[bors-openebs-mayastor]

👎 Rejected by label

[tiagolobocastro]

bors merge

[bors-openebs-mayastor]

Build succeeded:

• continuous-integration/jenkins/branch