Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for OpenSSL CVEs captured by upgraded bottlerocket SDK #331

Merged
merged 1 commit into from
Nov 1, 2022

Conversation

jpmcb
Copy link
Contributor

@jpmcb jpmcb commented Nov 1, 2022

Issue number:

N/a - Related to bottlerocket-os/bottlerocket-sdk#84 which includes patches for CVE-2022-3602 and CVE-2022-3786.

Description of changes:

Upgrades bottlerocket SDK

Testing done:

Coming soon ...

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

Signed-off-by: John McBride <jpmmcb@amazon.com>
@jpmcb
Copy link
Contributor Author

jpmcb commented Nov 1, 2022

Added a HACK commit to use the temporary testing beta SDK container which will be equivalent to the released v0.28 SDK image. Testing now ...

@jpculp jpculp self-requested a review November 1, 2022 19:38
@jpmcb jpmcb requested a review from gthao313 November 1, 2022 19:43
@jpmcb
Copy link
Contributor Author

jpmcb commented Nov 1, 2022

Testing

Built an image and pushed to testing registry. Updated image tags in the manifest locally with:

image: "xxxxxxxxx.dkr.ecr.us-west-2.amazonaws.com/bottlerocket-update-operator-test:thar-be-beta-test"

Started integration tests and passed 👍🏼

@jpmcb
Copy link
Contributor Author

jpmcb commented Nov 1, 2022

Force pushed to remove temporary HACK commit

@jpmcb jpmcb marked this pull request as ready for review November 1, 2022 20:09
@jpmcb jpmcb merged commit c1b9791 into bottlerocket-os:develop Nov 1, 2022
@jpmcb jpmcb deleted the fix-openssl-cve branch November 1, 2022 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants