From b62f0faa48dcaf88155f114431742a3f332bb551 Mon Sep 17 00:00:00 2001 From: Michael Zalimeni Date: Tue, 15 Oct 2024 21:29:35 -0400 Subject: [PATCH] add CVE IDs to changelog --- .changelog/21816.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.changelog/21816.txt b/.changelog/21816.txt index 280ef8289bff..40bc844beee9 100644 --- a/.changelog/21816.txt +++ b/.changelog/21816.txt @@ -1,9 +1,9 @@ ```release-note:security -mesh: Add `http.incoming.requestNormalization` to Mesh configuration entry to support inbound service traffic request normalization. +mesh: Add `http.incoming.requestNormalization` to Mesh configuration entry to support inbound service traffic request normalization. This resolves [CVE-2024-10005](https://nvd.nist.gov/vuln/detail/CVE-2024-10005) and [CVE-2024-10006](https://nvd.nist.gov/vuln/detail/CVE-2024-10006). ``` ```release-note:security -mesh: Add `contains` and `ignoreCase` to L7 Intentions HTTP header matching criteria to support configuration resilient to variable casing and multiple values. +mesh: Add `contains` and `ignoreCase` to L7 Intentions HTTP header matching criteria to support configuration resilient to variable casing and multiple values. This resolves [CVE-2024-10006](https://nvd.nist.gov/vuln/detail/CVE-2024-10006). ``` ```release-note:breaking-change -mesh: Enable Envoy `HttpConnectionManager.normalize_path` by default on inbound traffic to mesh proxies. +mesh: Enable Envoy `HttpConnectionManager.normalize_path` by default on inbound traffic to mesh proxies. This resolves [CVE-2024-10005](https://nvd.nist.gov/vuln/detail/CVE-2024-10005). ```