fix(deps): update module github.com/cilium/cilium to v1.14.14 [security] #1844
+46
−44
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.14.12
->v1.14.14
GitHub Vulnerability Alerts
CVE-2024-42488
Impact
A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/33511.
This issue affects:
This issue has been patched in:
Workarounds
As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.
Acknowledgements
The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @skmatti for raising and resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [email protected]. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Release Notes
cilium/cilium (github.com/cilium/cilium)
v1.14.14
: 1.14.14Compare Source
Security Advisories
This release addresses GHSA-q7w8-72mr-vpgw.
Summary of Changes
Bugfixes:
CI Changes:
Misc Changes:
Other Changes:
Docker Manifests
cilium
docker.io/cilium/cilium:v1.14.14@​sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637
quay.io/cilium/cilium:v1.14.14@​sha256:43d664501afbf35496e494dae0c5a7f8680a51ed9084997bea9c64bf4451a637
clustermesh-apiserver
docker.io/cilium/clustermesh-apiserver:v1.14.14@​sha256:43171d3f988ffa7b5ef58b7f329bab77a5382c620b56ed9a64909e4358174135
quay.io/cilium/clustermesh-apiserver:v1.14.14@​sha256:43171d3f988ffa7b5ef58b7f329bab77a5382c620b56ed9a64909e4358174135
docker-plugin
docker.io/cilium/docker-plugin:v1.14.14@​sha256:8f4722b3fc3b64438065eeb8d4a003f8166032bf2bc1bad0480495cd7f9feef2
quay.io/cilium/docker-plugin:v1.14.14@​sha256:8f4722b3fc3b64438065eeb8d4a003f8166032bf2bc1bad0480495cd7f9feef2
hubble-relay
docker.io/cilium/hubble-relay:v1.14.14@​sha256:6fdad9d7ce64efbb966745005a2060223d9677cc4407177171b865691ab00aac
quay.io/cilium/hubble-relay:v1.14.14@​sha256:6fdad9d7ce64efbb966745005a2060223d9677cc4407177171b865691ab00aac
kvstoremesh
docker.io/cilium/kvstoremesh:v1.14.14@​sha256:ac7b4ddc38abfa0a27a503c7453dc8a8d4b3b1b1e785b02fda3ccbe613987c41
quay.io/cilium/kvstoremesh:v1.14.14@​sha256:ac7b4ddc38abfa0a27a503c7453dc8a8d4b3b1b1e785b02fda3ccbe613987c41
operator-alibabacloud
docker.io/cilium/operator-alibabacloud:v1.14.14@​sha256:2a88642e1c76548a0c4d8e8fe2facaed5f6955040bdd4729a6d1090eafde5e49
quay.io/cilium/operator-alibabacloud:v1.14.14@​sha256:2a88642e1c76548a0c4d8e8fe2facaed5f6955040bdd4729a6d1090eafde5e49
operator-aws
docker.io/cilium/operator-aws:v1.14.14@​sha256:adb1ea6a98b2715c5bed74ba4ab9fab89f6862aff462a5a05acd0d8c39d3af80
quay.io/cilium/operator-aws:v1.14.14@​sha256:adb1ea6a98b2715c5bed74ba4ab9fab89f6862aff462a5a05acd0d8c39d3af80
operator-azure
docker.io/cilium/operator-azure:v1.14.14@​sha256:4a88010d124b70ca1b1df90e0ca40bd79a99e344f72bfc821b9ef490421d0f51
quay.io/cilium/operator-azure:v1.14.14@​sha256:4a88010d124b70ca1b1df90e0ca40bd79a99e344f72bfc821b9ef490421d0f51
operator-generic
docker.io/cilium/operator-generic:v1.14.14@​sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2
quay.io/cilium/operator-generic:v1.14.14@​sha256:0f2c8178bd20189fc9aeaa71224e6becdf71b42642209610b57390f7b798aae2
operator
docker.io/cilium/operator:v1.14.14@​sha256:8d1445bb129ccc56e6f2410369e0c9bacbb3ae9b7fde522c76734f01005e9ded
quay.io/cilium/operator:v1.14.14@​sha256:8d1445bb129ccc56e6f2410369e0c9bacbb3ae9b7fde522c76734f01005e9ded
v1.14.13
: 1.14.13Compare Source
Summary of Changes
We are pleased to release Cilium v1.14.13, which includes and updated Hubble UI, as well as stability and bug fixes. Thanks to all contributors, reviewers, testers, and users!
Minor Changes:
Bugfixes:
CI Changes:
Misc Changes:
511e3d9
(v1.14) (#33215, @cilium-renovate[bot])2eb85b8
(v1.14) (#33178, @cilium-renovate[bot])b405b62
(v1.14) (#33339, @cilium-renovate[bot])Other Changes:
Docker Manifests
cilium
docker.io/cilium/cilium:v1.14.13@​sha256:9cbbbaf0697756cb8ca2e2f67b8d3421918869e60e206b9309fb0689c101432f
quay.io/cilium/cilium:v1.14.13@​sha256:9cbbbaf0697756cb8ca2e2f67b8d3421918869e60e206b9309fb0689c101432f
clustermesh-apiserver
docker.io/cilium/clustermesh-apiserver:v1.14.13@​sha256:99ce2f49fe0ba5985a4746514adb51914572cf27be659f4735e5264df48759d1
quay.io/cilium/clustermesh-apiserver:v1.14.13@​sha256:99ce2f49fe0ba5985a4746514adb51914572cf27be659f4735e5264df48759d1
docker-plugin
docker.io/cilium/docker-plugin:v1.14.13@​sha256:e9b6885a0bcc1349047ca301fc82abcb6e6f9fdf06a72ea3603913e9c1c51e45
quay.io/cilium/docker-plugin:v1.14.13@​sha256:e9b6885a0bcc1349047ca301fc82abcb6e6f9fdf06a72ea3603913e9c1c51e45
hubble-relay
docker.io/cilium/hubble-relay:v1.14.13@​sha256:bdd411ed6f38904ffde4648d135ce8b38452932226b8325fd20cdc4dbb52c4b6
quay.io/cilium/hubble-relay:v1.14.13@​sha256:bdd411ed6f38904ffde4648d135ce8b38452932226b8325fd20cdc4dbb52c4b6
kvstoremesh
docker.io/cilium/kvstoremesh:v1.14.13@​sha256:b90bb713d05f9e0a26fc183520aa8916db0ed3eceaa876fba99df91d5b2a46e4
quay.io/cilium/kvstoremesh:v1.14.13@​sha256:b90bb713d05f9e0a26fc183520aa8916db0ed3eceaa876fba99df91d5b2a46e4
operator-alibabacloud
docker.io/cilium/operator-alibabacloud:v1.14.13@​sha256:84e5f93ecf618816202783874d5e58a272314f8d09d4b2ced36a48b5558d02f2
quay.io/cilium/operator-alibabacloud:v1.14.13@​sha256:84e5f93ecf618816202783874d5e58a272314f8d09d4b2ced36a48b5558d02f2
operator-aws
docker.io/cilium/operator-aws:v1.14.13@​sha256:f528f6856451784aae666a96d7b23e6b56f3d4b00b17e3639adfa1331d706601
quay.io/cilium/operator-aws:v1.14.13@​sha256:f528f6856451784aae666a96d7b23e6b56f3d4b00b17e3639adfa1331d706601
operator-azure
docker.io/cilium/operator-azure:v1.14.13@​sha256:b028c96d49eea3f4bacccd1b2fcd418f4490315467fb6cc74654c6d685f749d3
quay.io/cilium/operator-azure:v1.14.13@​sha256:b028c96d49eea3f4bacccd1b2fcd418f4490315467fb6cc74654c6d685f749d3
operator-generic
docker.io/cilium/operator-generic:v1.14.13@​sha256:04730b89598c886524356226e11cffb69f39ade35b0379ace10fe74e386b067d
quay.io/cilium/operator-generic:v1.14.13@​sha256:04730b89598c886524356226e11cffb69f39ade35b0379ace10fe74e386b067d
operator
docker.io/cilium/operator:v1.14.13@​sha256:9af18cf0c1bcc2bcba6d77d86b1853c36d4f7591dfb86027bbbccbab08d3cf02
quay.io/cilium/operator:v1.14.13@​sha256:9af18cf0c1bcc2bcba6d77d86b1853c36d4f7591dfb86027bbbccbab08d3cf02
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.