Skip to content

Commit 846f3d9

Browse files
committed
CVE-2024-56334 now fixed in 1.4.1
Signed-off-by: Nick Boldt <[email protected]> add CVE-2024-56334 to snip-fixed-security-issues-in-product-1.4.1.adoc Signed-off-by: Nick Boldt <[email protected]> add spaces back into the generated RN Signed-off-by: Nick Boldt <[email protected]> more fixes from JIRA updates Signed-off-by: Nick Boldt <[email protected]>
1 parent d517ccd commit 846f3d9

9 files changed

+102
-10
lines changed

modules/release-notes/list-fixed-security-issues-in-product-1.4.1.txt

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,4 @@ CVE-2024-56201, rhdh/rhdh-hub-rhel9: Jinja has a sandbox breakout through malici
33
CVE-2024-56326, rhdh/rhdh-hub-rhel9: Jinja has a sandbox breakout through indirect reference to format method
44
CVE-2024-55565, rhdh-hub-container: nanoid mishandles non-integer values
55
CVE-2024-52798, rhdh-hub-container: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
6-
7-
# not yet fixed for 1.4.z
8-
# CVE-2024-56334, rhdh/rhdh-hub-rhel9: Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
6+
CVE-2024-56334, rhdh/rhdh-hub-rhel9: Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation

modules/release-notes/ref-release-notes-breaking-changes.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ This section lists breaking changes in {product} {product-version}.
88
== Updated monitoring and logging metrics
99

1010
Prom-client metrics have been removed and replaced with OpenTelemetry metrics. As a result, the metrics port has changed from `7007` to `9464`. Deprecated metrics have also been removed. If you had dependencies on these, ensure your prometheus queries are updated. For further information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.3/html-single/monitoring_and_logging/index#assembly-rhdh-observability[Monitoring and logging]
11+
12+
1113
.Additional resources
1214
* link:https://issues.redhat.com/browse/RHIDP-4572[RHIDP-4572]
15+
1316
[id="removed-functionality-rhidp-4853"]
1417
== Plugins with updated scope
1518

@@ -86,6 +89,10 @@ With the update to the plugin scope, the dynamic plugin configuration has also b
8689
====
8790
In addition to the previously provided tables, you can compare the link:https://github.com/redhat-developer/red-hat-developers-documentation-rhdh/blob/release-1.4/modules/dynamic-plugins/rhdh-supported-plugins.csv[RHDH 1.4 CSV file] with the link:https://github.com/redhat-developer/red-hat-developers-documentation-rhdh/blob/release-1.3/modules/dynamic-plugins/rhdh-supported-plugins.csv[RHDH 1.3 CSV file] to identify the changes in dynamic plugins.
8891
====
92+
93+
8994
.Additional resources
9095
* link:https://issues.redhat.com/browse/RHIDP-4853[RHIDP-4853]
9196

97+
98+

modules/release-notes/ref-release-notes-deprecated-functionalities.adoc

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,28 @@ This section lists deprecated functionalities in {product} {product-version}.
88
== `./dynamic-plugins/dist/janus-idp-backstage-plugin-aap-backend-dynamic` plugin is deprecated
99

1010
The `./dynamic-plugins/dist/janus-idp-backstage-plugin-aap-backend-dynamic` plugin has been deprecated and will be removed in the next release. You can link:https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html-single/using_ansible_plug-ins_for_red_hat_developer_hub/index[use Ansible plug-ins for {product-very-short}] instead.
11+
12+
1113
.Additional resources
1214
* link:https://issues.redhat.com/browse/RHIDP-3545[RHIDP-3545]
15+
1316
[id="deprecated-functionality-rhidp-4913"]
1417
== Audit log rotation is deprecated
1518

1619
With this update, you can evaluate your platform&#39;s log forwarding solutions to align with your security and compliance needs. Most of these solutions offer configurable options to minimize the loss of logs in the event of an outage.
20+
21+
1722
.Additional resources
1823
* link:https://issues.redhat.com/browse/RHIDP-4913[RHIDP-4913]
24+
1925
[id="deprecated-functionality-rhidp-5218"]
2026
== {rhsso-brand-name} `7.6` is deprecated as an authentication provider
2127

2228
{rhsso-brand-name} ({rhsso}) `7.6` is deprecated as an authentication provider. You can continue to use {rhsso} until the end of maintenance support. For details, see link:https://access.redhat.com/support/policy/updates/jboss_notes/#p_sso[RHSSO lifecycle dates]. As an alternative, migrate to {rhbk-brand-name} `v24`.
29+
30+
2331
.Additional resources
2432
* link:https://issues.redhat.com/browse/RHIDP-5218[RHIDP-5218]
2533

34+
35+

modules/release-notes/ref-release-notes-fixed-issues.adoc

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,91 +13,121 @@ Previously, the GitHub issues plugin defaulted to using the first GitHub integra
1313

1414
Now, GitHub issues plugin supports multiple GitHub integration hosts. It uses the well-known entity slug annotation `backstage.io/source-location` or `backstage.io/managed-by-location` to determine the appropriate GitHub integration for a component. If no integration matches the slug, the first GitHub integration is selected, maintaining the previous behavior.
1515

16+
17+
1618
.Additional resources
1719
* link:https://issues.redhat.com/browse/RHIDP-2727[RHIDP-2727]
1820

21+
1922
[id="bug-fix-rhidp-2903"]
2023
=== All API documentation is defined in the 3scale backend plugin
2124

2225
Previously, some API documentation defined in the 3scale backend plugin was not accessible in {product-very-short}.
2326

2427
With this update, all API documentation defined in the 3scale backend plugin is imported and merged in the {product-very-short}.
28+
29+
2530
.Additional resources
2631
* link:https://issues.redhat.com/browse/RHIDP-2903[RHIDP-2903]
2732

33+
2834
[id="bug-fix-rhidp-3115"]
2935
=== {product-very-short} helm chart deployment throws `NotAllowedError`
3036

3137
Previously, when deploying with the Helm Chart, there could be a mismatch between the Route hostname and the `baseUrl` fields added to the generated app-config ConfigMap. This could sometimes cause failure to authenticate against some providers due to an origin mismatch.
3238

3339
This update fixes this issue by ensuring no mismatch between those values.
40+
41+
3442
.Additional resources
3543
* link:https://issues.redhat.com/browse/RHIDP-3115[RHIDP-3115]
3644

45+
3746
[id="bug-fix-rhidp-3849"]
3847
=== Disable the creation of permission policies and roles when disabling the RBAC backend plugin
3948

4049
Previously, disabling the Role-Based Access Control (RBAC) backend plugin created roles and permission policies, whether the permission framework was enabled or not.
4150

4251
With this update, disabling the RBAC backend plugin no longer creates roles and permission policies.
52+
53+
4354
.Additional resources
4455
* link:https://issues.redhat.com/browse/RHIDP-3849[RHIDP-3849]
4556

57+
4658
[id="bug-fix-rhidp-3931"]
4759
=== Added alert on the deletion icon during bulk imports
4860

4961
Before this update, repositories were added to the {product-short} from various sources, such as `app-config` files or GitHub discovery. The Bulk Import plugin only tracked repositories accessible using the configured GitHub integrations. When both plugins were enabled, repositories discovered by GitHub Discovery appeared on Bulk Import pages. However, deleting these repositories from Bulk Import Jobs had no effect, as entities from discovery or `app-config.yaml` file remained in the {product-short} catalog.
5062

5163
With this update, an alert on the deletion icon notifies the user to modify the source (either the `catalog-info` within the repository or the `app-config.yaml` file if the file originates from there) to remove the catalog entity.
5264

65+
66+
5367
.Additional resources
5468
* link:https://issues.redhat.com/browse/RHIDP-3931[RHIDP-3931]
5569

70+
5671
[id="bug-fix-rhidp-4240"]
5772
=== Removed the pre-configured custom resources from the Kubernetes configuration
5873

5974
Before this update, the custom resources in Kubernetes configuration were pre-configured. As a result, users could see Tekton warnings without configuring the custom resources in Kubernetes.
6075

6176
This update removes the pre-configured custom resources from the Kubernetes configuration. Therefore, users can customize resources to the Kubernetes configuration based on their requirements, preventing unrelated warnings from appearing.
77+
78+
6279
.Additional resources
6380
* link:https://issues.redhat.com/browse/RHIDP-4240[RHIDP-4240]
6481

82+
6583
[id="bug-fix-rhidp-4241"]
6684
=== RBAC Plugin is broken with latest Backstage version (`1.31`)
6785

6886
Before this update, Role-Based Access Control (RBAC) backend plugin broke in Backstage `1.31` with an error.
6987

7088
This update resolves compatibility issues with RBAC backend plugin on Backstage versions `1.31` and `1.32` without displaying any errors.
89+
90+
7191
.Additional resources
7292
* link:https://issues.redhat.com/browse/RHIDP-4241[RHIDP-4241]
7393

94+
7495
[id="bug-fix-rhidp-4732"]
7596
=== The backstage instance always failed to start in version `5.1.0`
7697

7798
Before this update, the backstage instance failed to start in version `5.1.0`, showing an error.
7899

79100
With this update, the Role-Based Access Control (RBAC) Backend plugin now starts successfully in version `5.1.0` without displaying any errors.
101+
102+
80103
.Additional resources
81104
* link:https://issues.redhat.com/browse/RHIDP-4732[RHIDP-4732]
82105

106+
83107
[id="bug-fix-rhidp-4734"]
84108
=== Resolved RBAC API inconsistency when scaling deployments to more than one pod
85109

86110
Before this update, scaling the deployment to more than one pod caused Role-Based Access Control (RBAC) roles to remain unsynced, allowing only the pod that created the resource to serve it.
87111

88112
With this update, RBAC roles are now properly synced across all pods, with Redis cache and traffic routing configured to ensure consistency across the deployment.
113+
114+
89115
.Additional resources
90116
* link:https://issues.redhat.com/browse/RHIDP-4734[RHIDP-4734]
91117

118+
92119
[id="bug-fix-rhidp-5014"]
93120
=== `export-dynamic-plugin` fails to find dependencies nested deeper than one level in `node_modules`
94121

95-
Previously, the CLI examined the dependencies of embedded packages during the export process to know if other packages should be embedded. One of the methods was calling {{require}} when the CLI encountered a built embedded package, which was the case when wrapping an existing plugin.
122+
Previously, the CLI examined the dependencies of embedded packages during the export process to know if other packages should be embedded. One of the methods was calling `require` when the CLI encountered a built embedded package, which was the case when wrapping an existing plugin.
96123

97-
This update changes the parent directory that the {{require}} uses from the monorepo root to the embedded package. Therefore, the dependent package found is the dependency that is most relevant to the embedded package.
124+
This update changes the parent directory that the `require` uses from the monorepo root to the embedded package. Therefore, the dependent package found is the dependency that is most relevant to the embedded package.
125+
126+
98127
.Additional resources
99128
* link:https://issues.redhat.com/browse/RHIDP-5014[RHIDP-5014]
100129

130+
101131
[id="bug-fix-rhidp-5062"]
102132
=== `suppress-native-package` and `allow-native-package` flags to handle native modules
103133

@@ -107,40 +137,56 @@ This update introduces two new CLI flags that help dynamic plugin developers han
107137

108138

109139

140+
141+
110142
.Additional resources
111143
* link:https://issues.redhat.com/browse/RHIDP-5062[RHIDP-5062]
112144

145+
113146
[id="bug-fix-rhidp-5120"]
114147
=== Resolved the issue with text selection when reporting a TechDoc issue
115148

116149
Previously, the feature to report a documentation (TechDoc) issue failed. Therefore, when a user selected a text in a TechDoc, a large icon appeared instead of a tooltip button.
117150

118151
With this update, users can select texts when reporting a documentation (TechDoc) issue.
152+
153+
119154
.Additional resources
120155
* link:https://issues.redhat.com/browse/RHIDP-5120[RHIDP-5120]
121156

157+
122158
[id="bug-fix-rhidp-5136"]
123159
=== Resolved the `stdout maxBuffer` error
124160

125161
Previously, the `export-dynamic-plugin` failed with an error that the `stdout maxBuffer` length was exceeded.
126162

127-
With this update, the CLI redirects the output of the {{yarn install}} command it performs during the export process to a file. Therefore, a successful completion of the {{yarn install}} command and verification of the `export-dynamic-plugin`, cleans up the file. The file is available for troubleshooting when the dynamic plugin validation checks fail.
163+
With this update, the CLI redirects the output of the `yarn install` command it performs during the export process to a file. Therefore, a successful completion of the `yarn install` command and verification of the `export-dynamic-plugin`, cleans up the file. The file is available for troubleshooting when the dynamic plugin validation checks fail.
164+
165+
128166
.Additional resources
129167
* link:https://issues.redhat.com/browse/RHIDP-5136[RHIDP-5136]
130168

169+
131170
[id="bug-fix-rhidp-5141"]
132171
=== Added an `--ignore-version-check` flag
133172

134173
Previously, exporting a plugin that has not been updated to a newer backstage version failed due to a semver check performed on dependencies of the dynamic plugin package.
135174

136175
With this update, an `--ignore-version-check` flag accepts a list of package names causing the CLI to selectively ignore the semver check the CLI performs when evaluating the plugin package dependencies. Therefore, a plugin that has not been updated works because it relies on unchanged interfaces and functions.
176+
177+
137178
.Additional resources
138179
* link:https://issues.redhat.com/browse/RHIDP-5141[RHIDP-5141]
139180

181+
140182
[id="bug-fix-rhidp-5297"]
141183
=== Updated the Tech Radar plugin
142184

143185
With this update, you are now required to enable both `./dynamic-plugins/dist/backstage-community-tech-radar` and `./dynamic-plugins/dist/backstage-community-tech-radar-backend-dynamic` to use the Tech Radar plugin. You must configure additional settings depending on where you choose to load the JSON data for the plugin.
186+
187+
144188
.Additional resources
145189
* link:https://issues.redhat.com/browse/RHIDP-5297[RHIDP-5297]
146190

191+
192+

modules/release-notes/ref-release-notes-known-issues.adoc

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,22 +10,32 @@ This section lists known issues in {product} {product-version}.
1010
Currently, when deploying {product-short} using the Helm Chart, two replicas cannot run on different cluster nodes. This might also affect the upgrade from 1.3 to 1.4.0 if the new pod is scheduled on a different node.
1111

1212
A possible workaround for the upgrade is to manually scale down the number of replicas to 0 before upgrading your Helm release. Or manually remove the old {product-short} pod after upgrading the Helm release. However, this would imply some application downtime. You can also leverage a Pod Affinity rule to force the cluster scheduler to run your {product-short} pods on the same node.
13+
14+
1315
.Additional resources
1416
* link:https://issues.redhat.com/browse/RHIDP-5344[RHIDP-5344]
17+
1518
[id="known-issue-rhidp-5342"]
16-
== [Helm] Cannot run 2 RHDH replicas on different nodes due to Multi-Attach errors on the dynamic plugins root PVC
19+
== [Helm] Cannot run two RHDH replicas on different nodes due to Multi-Attach errors on the dynamic plugins root PVC
1720

1821
If you are deploying {product-short} using the Helm Chart, it is currently impossible to have 2 replicas running on different cluster nodes. This might also affect the upgrade from 1.3 to 1.4.0 if the new pod is scheduled on a different node.
1922

2023
A possible workaround for the upgrade is to manually scale down the number of replicas to 0 before upgrading your Helm release. Or manually remove the old {product-short} pod after upgrading the Helm release. However, this would imply some application downtime.
2124
You can also leverage a Pod Affinity rule to force the cluster scheduler to run your {product-short} pods on the same node.
2225

26+
27+
2328
.Additional resources
2429
* link:https://issues.redhat.com/browse/RHIDP-5342[RHIDP-5342]
30+
2531
[id="known-issue-rhidp-3396"]
2632
== Topology plugin permission is not displayed in the RBAC front-end UI
2733

2834
Permissions associated only with front-end plugins do not appear in the UI because they require a backend plugin to expose the permission framework&#39;s well-known endpoint. As a workaround, you can apply these permissions by using a CSV file or directly calling the REST API of the RBAC backend plugin. Affected plugins include Topology (`topology.view.read`), Tekton (`tekton.view.read`), ArgoCD (`argocd.view.read`), and Quay (`quay.view.read`).
35+
36+
2937
.Additional resources
3038
* link:https://issues.redhat.com/browse/RHIDP-3396[RHIDP-3396]
3139

40+
41+

modules/release-notes/ref-release-notes-new-features.adoc

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,26 +8,30 @@ This section highlights new features in {product} {product-version}.
88
== Added an individual `mountPath`
99

1010
This update adds an additional individual `mountPath` for extra configmaps or secrets.
11+
1112
[id="feature-rhidp-3621"]
1213
== `PersistentVolumeClaims` support is available
1314

1415
With this update, link:https://github.com/redhat-developer/rhdh-operator/blob/main/docs/configuration.md#persistentvolumeclaims[`PersistentVolumeClaims` (PVC)] support is available.
16+
1517
[id="feature-rhidp-3817"]
1618
== Added Configuration Profiles
1719

1820
With this update, there are additional link:https://github.com/redhat-developer/rhdh-operator/blob/main/docs/profiles.md[configuration profiles].
21+
1922
[id="enhancement-rhidp-4384"]
2023
== Enhanced use of `kube-rbac-proxy`
2124

2225
This update removes the `kube-rbac-proxy` sidecar container from the RHDH Operator Pod. This sidecar container protected the operator metrics endpoint. However, the main container now provides this functionality out-of-the-box. Removing this sidecar container allows for reducing the resources required to run the Operator.
26+
2327
[id="feature-rhidp-4414"]
2428
== Identifying Backstage flavor for plugins by using the `developerHub.flavor` field
2529

2630
With this update, you can use the `developerHub.flavor` field to identify whether plugins are running on {product-very-short}, {rhtap-very-short}, or vanilla Backstage, as shown in the following example:
2731

2832
.`app-config.yaml` fragment with the `developerhub.flavor` field
2933

30-
[source,yaml]
34+
[source,yaml,subs=&#34;quotes&#34;]
3135
----
3236
developerHub:
3337
flavor: &lt;flavor&gt;;
@@ -36,24 +40,30 @@ developerHub:
3640
`flavor`::
3741
Identify the flavor of Backstage that is running. Default value: `rhdh`
3842

43+
3944
[id="feature-rhidp-4419"]
4045
== Ability to manage PVCs in RHDH Operator
4146

4247
You can now mount directories from pre-created PersistentVolumeClaims (PVCs) using the `spec.application.extraFiles.pvcs` field, while configuring RHDH Operator.
4348
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.4/html-single/configuring/index#configuring-the-deployment[Persistent Volume Claim (PVC)].
4449

50+
4551
[id="feature-rhidp-4805"]
4652
== Authenticating with {rhbk-brand-name}
4753

4854
With this update, you can use {rhbk-brand-name} as an authentication provider. The Keycloak plugin will now support ingesting users and groups with {rhbk-brand-name}. For more details, see link:https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.0/html-single/getting_started_guide/index#getting-started-zip-start-red-hat-build-of-keycloak[Authentication with {rhbk-brand-name}].
55+
4956
[id="feature-rhidp-4806"]
5057
== Ability to install third-party plugins in RHDH
5158

5259
You can now install third-party plugins in {product} without rebuilding the {product-very-short} application.
5360

5461
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.4/html-single/introduction_to_plugins/index[Third party plugins].
62+
5563
[id="feature-rhidp-5156"]
5664
== The catalog backend module logs plugin is enabled
5765

5866
With this update, the `backstage-plugin-catalog-backend-module-logs` is enabled and converted to a static plugin improving performance and stability. The dynamic plugin was disabled in version `1.3`.
5967

68+
69+

modules/release-notes/ref-release-notes-technology-preview.adoc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ With this update, {product-short} includes the following dynamic plugins to mana
2424

2525
These plugins are disabled by default.
2626

27+
28+
2729
.Additional resources
2830
* link:https://issues.redhat.com/browse/RHIDP-5545[RHIDP-5545]
2931

32+
33+

modules/release-notes/single-source-release-notes-template.adoc.jinja

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@
1616
== {{ issue.fields.summary }}
1717
{% endif %}
1818
{{ issue.fields.customfield_12317313 }}
19-
{% if template == "with-jira-link" or template == "with-z-stream-section" %}.Additional resources
19+
{% if template == "with-jira-link" or template == "with-z-stream-section" %}
20+
21+
.Additional resources
2022
* link:https://issues.redhat.com/browse/{{ issue.key }}[{{ issue.key }}]
21-
{% endif %}{% endfor %}{% if not vars -%}None.{% endif -%}
23+
{% endif %}
24+
{% endfor %}
25+
{% if not vars -%}None.{% endif -%}

0 commit comments

Comments
 (0)