Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of [NET-2420] security: re-enable security scan release block into release/1.4.x #3651

Merged
merged 2 commits into from
Feb 21, 2024
Merged

Backport of [NET-2420] security: re-enable security scan release block into release/1.4.x #3651

merged 2 commits into from
Feb 21, 2024

Commits on Feb 21, 2024

  1. security: re-enable security scan release block 

    This was previously disabled due to an unresolved false-positive CVE.
Re-enabling both secrets and OSV + Go Modules scanning, which per our
current scan results should not be a blocker to future releases.

Also add security scans on PR and merge to protected branches to allow
proactive triage going forward.

See hashicorp/consul#19978 for similar change in that repo, adapted
here.
    @zalimeni
    zalimeni committed Feb 21, 2024
    Configuration menu
    Copy the full SHA
    6e6e315 View commit details
    Browse the repository at this point in the history

  2. security: add scan triage for CVE-2024-25620 (helm/v3) 

    Triage this scan result as `consul-k8s` should not be directly
impacted and it is medium severity. Follow-up ticket filed for
remediation.

Also improve formatting of scan config since this change will be
backported.
    @zalimeni
    zalimeni committed Feb 21, 2024
    Configuration menu
    Copy the full SHA
    eceb562 View commit details
    Browse the repository at this point in the history