openshift/machine-config-operator

machine-config-operator is depending on github.com/coreos/ignition@v0.35.0 which is has security vulnerability

liuyuan10 opened this issue · 4 comments

liuyuan10 commented

We are using https://github.com/k8snetworkplumbingwg/sriov-network-operator which pulls in machine-config-operator.

machine-config-operator is depending on both of the ignition version

	github.com/coreos/ignition v0.35.0
	github.com/coreos/ignition/v2 v2.15.0

https://github.com/openshift/machine-config-operator/blob/master/go.mod#L18

Our security scanning notice there is https://security-tracker.debian.org/tracker/CVE-2022-1706 in ignition before version v2.14.0. But with both versions imported, I don't see an easy way to fix such alert. Is there any recommendation on how we can solve it?

openshift-bot commented

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot commented

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

openshift-bot commented

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

openshift-ci commented

@openshift-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.