CVE-2019-11254

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Due to unbounded aliasing, a crafted YAML file can cause consumption of significant system resources. If parsing user supplied input, this may be used as a denial of service vector.

These are all security issues fixed in the etcd-3.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for etcd fixes the following issues:

Update to version 3.5.12:

• Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
• test: fix TestHashKVWhenCompacting: ensure all goroutine finished
• print error log when creating peer listener failed
• mvcc: Printing etcd backend database related metrics inside scheduleCompaction function
• dependency: update go version to 1.20.13
• commit bbolt transaction if there is any pending deleting operations
• add tests to test tx delete consistency.
• Don't flock snapshot files
• Backport adding digest for etcd base image.
• Add a unit tests and missing flags in etcd help.
• Add missing flag in etcd help.
• Backport testutils.ExecuteUntil to 3.5 branch
• member replace e2e test
• Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517
• Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer
• test: enable gofail in release e2e test.
• [3.5] backport health check e2e tests.
• tests: Extract e2e cluster setup to separate package

• Update to version 3.5.11:

  • etcdserver: add linearizable_read check to readyz.
  • etcd: Update go version to 1.20.12
  • server: disable redirects in peer communication
  • etcdserver: add metric counters for livez/readyz health checks.
  • etcdserver: add livez and ready http endpoints for etcd.
  • http health check bug fixes
  • server: Split metrics and health code
  • server: Cover V3 health with tests
  • server: Refactor health checks
  • server: Run health check tests in subtests
  • server: Rename test case expect fields
  • server: Use named struct initialization in healthcheck test
  • Backport server: Don't follow redirects when checking peer urls.
  • Backport embed: Add tracing integration test.
  • Backport server: Have tracingExporter own resources it initialises.
  • Backport server: Add sampling rate to distributed tracing.
  • upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent
  • CVE-2023-47108: Backport go.opentelemetry.io/otel@v1.20.0 and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.46.0
  • github workflow: run arm64 tests on every push
  • etcd: upgrade go version from 1.20.10 to 1.20.11
  • bump bbolt to 1.3.8 for etcd 3.5
  • 3.5: upgrade gRPC-go to 1.58.3
  • Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'
  • etcdserver: add cluster id check for hashKVHandler
  • [release-3.5]: upgrade gRPC-go to v1.52.0
  • backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)
  • Return to default write scheduler since golang.org/x/net@v0.11.0 started using round robin
  • Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740
  • bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740
  • etcd: upgrade go version to 1.20.9
  • Remove obsolete http 1.0 version.
  • fix:Ensure that go version is only defined in one file for release-3.5
  • Fix panic in etcd validate secure endpoints
  • dependency: bump golang to 1.20.8
  • Backport redirect metrics data into file to reduce output.
  • test.sh: increase timeout for grpcproxy test
  • test: add v3 curl test to cover maintenance hash/hashkv REST API
  • api: fix duplicate gateway url issue
  • pkg: add a verification on the pagebytes which must be > 0
  • tests: Backport deflake for TestWatchDelay
  • tests: Backport deflake for TestPageWriterRandom
  • Backport adding unit test for socket options.
  • Backport export reuse-port and reuse-address
  • Fix goword failure in rafthttp/transport.go.
  • Backport update to golang 1.20 minor release.
  • bump go version to 1.19.12
  • Update workflows to use makefile recipes for unit, integration & e2e-release.
  • Backport Makefile recipes for common test…