Skip to content

Commit ebd6ef1

Browse files
nickboldtrhdh-bot
nickboldt
and
rhdh-bot
authored
chore(release notes): 1.3.2/1.3.3 release notes (RHIDP-4909) (#731)
* chore(release notes): initial draft of the 1.3.2 release notes (RHIDP-4909) Signed-off-by: Nick Boldt <[email protected]> * more CVEs already fixed (freshmaker issues) Signed-off-by: Nick Boldt <[email protected]> * add CVE-2024-21538,cross-spawn,7.0.5,RHIDP-4864 to fixed payload Signed-off-by: Nick Boldt <[email protected]> * regen other fixed issues Signed-off-by: Nick Boldt <[email protected]> * re-add the KI for RHID-3931 Signed-off-by: Nick Boldt <[email protected]> * fix comment syntax Signed-off-by: Nick Boldt <[email protected]> * add another missing bug fix; change formatting so that the fixed issues are per z-stream release Signed-off-by: Nick Boldt <[email protected]> * rename 1.3.2 -> 1.3.3 to be consistent with the CSV and chart version Signed-off-by: RHDH Build (rhdh-bot) <[email protected]> * Update assemblies/assembly-release-notes-known-issues.adoc --------- Signed-off-by: Nick Boldt <[email protected]> Signed-off-by: RHDH Build (rhdh-bot) <[email protected]> Co-authored-by: RHDH Build (rhdh-bot) <[email protected]>
1 parent 5b3104a commit ebd6ef1

9 files changed

+134
-30
lines changed

‎artifacts/attributes.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@
1111
:product-short: Developer Hub
1212
:product-very-short: RHDH
1313
:product-version: 1.3
14-
:product-bundle-version: 1.3.0
15-
:product-chart-version: 1.3.0
14+
:product-bundle-version: 1.3.3
15+
:product-chart-version: 1.3.3
1616
:product-backstage-version: 1.29.2
1717
:rhdeveloper-name: Red Hat Developer
1818
:rhel: Red Hat Enterprise Linux

‎assemblies/assembly-release-notes-fixed-issues.adoc‎

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,73 +2,77 @@
22
[id="fixed-issues"]
33
= Fixed issues
44

5-
This section lists issues fixed in {product} {product-version}.
5+
== Fixed issues in {product} 1.3.3
66

7+
include::modules/release-notes/snip-bug-fix-rhidp-5121.adoc[leveloffset=+2]
78

8-
include::modules/release-notes/snip-bug-fix-rhidp-1334.adoc[leveloffset=+1]
9+
== Fixed issues in {product} 1.3.1
910

11+
include::modules/release-notes/snip-bug-fix-rhidp-4069.adoc[leveloffset=+2]
1012

11-
include::modules/release-notes/snip-bug-fix-rhidp-2139.adoc[leveloffset=+1]
13+
== Fixed issues in {product} 1.3.0
1214

15+
include::modules/release-notes/snip-bug-fix-rhidp-1334.adoc[leveloffset=+2]
1316

14-
include::modules/release-notes/snip-bug-fix-rhidp-2374.adoc[leveloffset=+1]
1517

18+
include::modules/release-notes/snip-bug-fix-rhidp-2139.adoc[leveloffset=+2]
1619

17-
include::modules/release-notes/snip-bug-fix-rhidp-2412.adoc[leveloffset=+1]
1820

21+
include::modules/release-notes/snip-bug-fix-rhidp-2374.adoc[leveloffset=+2]
1922

20-
include::modules/release-notes/snip-bug-fix-rhidp-2438.adoc[leveloffset=+1]
2123

24+
include::modules/release-notes/snip-bug-fix-rhidp-2412.adoc[leveloffset=+2]
2225

23-
include::modules/release-notes/snip-bug-fix-rhidp-2529.adoc[leveloffset=+1]
2426

27+
include::modules/release-notes/snip-bug-fix-rhidp-2438.adoc[leveloffset=+2]
2528

26-
include::modules/release-notes/snip-bug-fix-rhidp-2716.adoc[leveloffset=+1]
2729

30+
include::modules/release-notes/snip-bug-fix-rhidp-2529.adoc[leveloffset=+2]
2831

29-
include::modules/release-notes/snip-bug-fix-rhidp-2728.adoc[leveloffset=+1]
3032

33+
include::modules/release-notes/snip-bug-fix-rhidp-2716.adoc[leveloffset=+2]
3134

32-
include::modules/release-notes/snip-bug-fix-rhidp-3159.adoc[leveloffset=+1]
3335

36+
include::modules/release-notes/snip-bug-fix-rhidp-2728.adoc[leveloffset=+2]
3437

35-
include::modules/release-notes/snip-bug-fix-rhidp-3217.adoc[leveloffset=+1]
3638

39+
include::modules/release-notes/snip-bug-fix-rhidp-3159.adoc[leveloffset=+2]
3740

38-
include::modules/release-notes/snip-bug-fix-rhidp-3260.adoc[leveloffset=+1]
3941

42+
include::modules/release-notes/snip-bug-fix-rhidp-3217.adoc[leveloffset=+2]
4043

41-
include::modules/release-notes/snip-bug-fix-rhidp-3458.adoc[leveloffset=+1]
4244

45+
include::modules/release-notes/snip-bug-fix-rhidp-3260.adoc[leveloffset=+2]
4346

44-
include::modules/release-notes/snip-bug-fix-rhidp-3471.adoc[leveloffset=+1]
4547

48+
include::modules/release-notes/snip-bug-fix-rhidp-3458.adoc[leveloffset=+2]
4649

47-
include::modules/release-notes/snip-bug-fix-rhidp-3580.adoc[leveloffset=+1]
4850

51+
include::modules/release-notes/snip-bug-fix-rhidp-3471.adoc[leveloffset=+2]
4952

50-
include::modules/release-notes/snip-bug-fix-rhidp-3601.adoc[leveloffset=+1]
5153

54+
include::modules/release-notes/snip-bug-fix-rhidp-3580.adoc[leveloffset=+2]
5255

53-
include::modules/release-notes/snip-bug-fix-rhidp-3612.adoc[leveloffset=+1]
5456

57+
include::modules/release-notes/snip-bug-fix-rhidp-3601.adoc[leveloffset=+2]
5558

56-
include::modules/release-notes/snip-bug-fix-rhidp-3735.adoc[leveloffset=+1]
5759

60+
include::modules/release-notes/snip-bug-fix-rhidp-3612.adoc[leveloffset=+2]
5861

59-
include::modules/release-notes/snip-bug-fix-rhidp-3896.adoc[leveloffset=+1]
6062

63+
include::modules/release-notes/snip-bug-fix-rhidp-3735.adoc[leveloffset=+2]
6164

62-
include::modules/release-notes/snip-bug-fix-rhidp-4013.adoc[leveloffset=+1]
6365

66+
include::modules/release-notes/snip-bug-fix-rhidp-3896.adoc[leveloffset=+2]
6467

65-
include::modules/release-notes/snip-bug-fix-rhidp-4046.adoc[leveloffset=+1]
6668

69+
include::modules/release-notes/snip-bug-fix-rhidp-4013.adoc[leveloffset=+2]
6770

68-
include::modules/release-notes/snip-bug-fix-rhidp-4069.adoc[leveloffset=+1]
6971

72+
include::modules/release-notes/snip-bug-fix-rhidp-4046.adoc[leveloffset=+2]
7073

71-
include::modules/release-notes/snip-bug-fix-rhidp-4200.adoc[leveloffset=+1]
74+
75+
include::modules/release-notes/snip-bug-fix-rhidp-4200.adoc[leveloffset=+2]
7276

7377

7478

‎assemblies/assembly-release-notes-fixed-security-issues.adoc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ This section lists security issues fixed in {product} {product-version}.
66

77
== {product} {product-bundle-version}
88

9+
include::./modules/release-notes/snip-fixed-security-issues-in-product-1.3.3.adoc[leveloffset=+2]
10+
11+
include::./modules/release-notes/snip-fixed-security-issues-in-rpm-1.3.3.adoc[leveloffset=+2]
12+
13+
== {product} 1.3.1
14+
915
include::./modules/release-notes/snip-fixed-security-issues-in-product-1.3.1.adoc[leveloffset=+2]
1016

1117
include::./modules/release-notes/snip-fixed-security-issues-in-rpm-1.3.1.adoc[leveloffset=+2]

‎assemblies/assembly-release-notes-known-issues.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ include::modules/release-notes/snip-known-issue-rhidp-4378.adoc[leveloffset=+1]
1010

1111
include::modules/release-notes/snip-known-issue-rhidp-4067.adoc[leveloffset=+1]
1212

13+
// fixed in 1.4, present in 1.3
14+
include::modules/release-notes/snip-known-issue-rhidp-3931.adoc[leveloffset=+1]
1315

16+
// fixed in 1.5, present in 1.3
1417
include::modules/release-notes/snip-known-issue-rhidp-3396.adoc[leveloffset=+1]
1518

16-
17-
include::modules/release-notes/snip-known-issue-rhidp-3931.adoc[leveloffset=+1]
18-

‎modules/release-notes/list-fixed-security-issues-in-product-1.3.2.txt‎ renamed to ‎modules/release-notes/list-fixed-security-issues-in-product-1.3.3.txt‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,2 @@
11
# CVE number, affected package, fixed in version(s), JIRA
2-
3-
# not yet fixed, built, or ready for release
2+
CVE-2024-21538,cross-spawn,7.0.5,RHIDP-4864

‎modules/release-notes/list-fixed-security-issues-in-rpm-1.3.3.txt‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# CVE number, Errata details, Bugzilla
2+
3+
# high prio fix in krb5-1.21.1-4.el9_5 (RHEL 9.5 update) reported by Prograde - see https://issues.redhat.com/browse/RHIDP-4891
4+
CVE-2024-3596, freeradius: forgery attack, https://bugzilla.redhat.com/show_bug.cgi?id=2263240
5+
6+
# moderate prio fixes reported by Prograde - see https://issues.redhat.com/browse/RHIDP-4891
7+
CVE-2024-30203, emacs: Gnus treats inline MIME contents as trusted, https://bugzilla.redhat.com/show_bug.cgi?id=2280296
8+
CVE-2024-30204, emacs: LaTeX preview is enabled by default for e-mail attachments, https://bugzilla.redhat.com/show_bug.cgi?id=2280297
9+
CVE-2024-30205, emacs: Org mode considers contents of remote files to be trusted, https://bugzilla.redhat.com/show_bug.cgi?id=2280298
10+
# https://errata.engineering.redhat.com/advisory/142796 -> https://access.redhat.com/errata/RHSA-2024:9541
11+
CVE-2024-50602, libexpat: expat: DoS via XML_ResumeParser, https://bugzilla.redhat.com/show_bug.cgi?id=2321987
12+
CVE-2024-2236, libgcrypt: vulnerable to Marvin Attack, https://bugzilla.redhat.com/show_bug.cgi?id=2245218
13+
CVE-2024-0450, python: The zipfile module is vulnerable to zip-bombs leading to denial of service, https://bugzilla.redhat.com/show_bug.cgi?id=2276525
14+
CVE-2024-8088, python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service, https://bugzilla.redhat.com/show_bug.cgi?id=2307370
15+
16+
# https://errata.engineering.redhat.com/advisory/129215 contains 4 issues
17+
CVE-2024-3727, containers/image: digest type does not guarantee valid type
18+
CVE-2024-24788, golang: net: malformed DNS message can cause infinite loop
19+
CVE-2024-6104, go-retryablehttp: url might write sensitive information to log file
20+
CVE-2024-24791, net/http: Denial of service due to improper 100-continue handling in net/http
21+
22+
# https://errata.engineering.redhat.com/advisory/128795 includes 478 bugs fixed in RHEL 9.5 with kernel-5.14.0-503.11.1.el9_5 - only listing one of them here
23+
CVE-2024-45005, kernel: KVM: s390: fix validity interception issue when gisa is switched off, https://bugzilla.redhat.com/show_bug.cgi?id=2309868
24+
# https://errata.engineering.redhat.com/advisory/142823 -> https://access.redhat.com/errata/RHSA-2024:9605
25+
CVE-2024-42283, kernel
26+
CVE-2024-46824, kernel
27+
CVE-2024-46858, kernel

‎modules/release-notes/snip-bug-fix-rhidp-5121.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[id="bug-fix-rhidp-5121"]
2+
= Huge icon when techdoc text is selected, and broken reporting feature
3+
4+
Previously, the feature to report a documentation (techdoc) issue didn't work.
5+
6+
When the user selects a text in a techdoc it shows a huge icon instead of a tooltip-button.
7+
8+
The latest version contains a fix for this so the user can select some content in their documentation to report an issue there.
9+
10+
.Additional resources
11+
* link:https://issues.redhat.com/browse/RHIDP-5121[RHIDP-5121]

‎modules/release-notes/snip-fixed-security-issues-in-product-1.3.3.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
= {product} dependency updates
2+
3+
link:https://access.redhat.com/security/cve/CVE-2024-21538[CVE-2024-21538]::
4+
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.

‎modules/release-notes/snip-fixed-security-issues-in-rpm-1.3.3.adoc‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
= RHEL 9 platform RPM updates
2+
3+
link:https://access.redhat.com/security/cve/CVE-2024-0450[CVE-2024-0450]::
4+
A flaw was found in the Python/CPython 'zipfile' that can allow a zip-bomb type of attack. An attacker may craft a zip file format, leading to a Denial of Service when processed.
5+
6+
link:https://access.redhat.com/security/cve/CVE-2024-2236[CVE-2024-2236]::
7+
A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.
8+
9+
link:https://access.redhat.com/security/cve/CVE-2024-3596[CVE-2024-3596]::
10+
A vulnerability in the RADIUS (Remote Authentication Dial-In User Service) protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof UDP-based RADIUS response packets. This can result in unauthorized access by modifying an Access-Reject response to an Access-Accept response, thereby compromising the authentication process.
11+
12+
link:https://access.redhat.com/security/cve/CVE-2024-3727[CVE-2024-3727]::
13+
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
14+
15+
link:https://access.redhat.com/security/cve/CVE-2024-6104[CVE-2024-6104]::
16+
A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information.
17+
18+
link:https://access.redhat.com/security/cve/CVE-2024-8088[CVE-2024-8088]::
19+
A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and become unresponsive. This flaw allows an attacker to craft a malicious ZIP archive, leading to a denial of service from the application consuming the zipfile module. Only applications that handle user-controlled zip archives are affected by this vulnerability.
20+
21+
link:https://access.redhat.com/security/cve/CVE-2024-24788[CVE-2024-24788]::
22+
A flaw was found in the net package of the Go stdlib. When a malformed DNS message is received as a response to a query, the Lookup functions within the net package can get stuck in an infinite loop. This issue can lead to resource exhaustion and denial of service (DoS) conditions.
23+
24+
link:https://access.redhat.com/security/cve/CVE-2024-24791[CVE-2024-24791]::
25+
A flaw was found in Go. The net/http module mishandles specific server responses from HTTP/1.1 client requests. This issue may render a connection invalid and cause a denial of service.
26+
27+
link:https://access.redhat.com/security/cve/CVE-2024-30203[CVE-2024-30203]::
28+
A flaw was found in Emacs. When Emacs is used as an email client, inline MIME attachments are considered to be trusted by default, allowing a crafted LaTeX document to exhaust the disk space or the inodes allocated for the partition where the /tmp directory is located. This issue possibly results in a denial of service.
29+
30+
link:https://access.redhat.com/security/cve/CVE-2024-30204[CVE-2024-30204]::
31+
A flaw was found in Emacs. When Emacs is used as an email client, a preview of a crafted LaTeX document attached to an email can exhaust the disk space or the inodes allocated for the partition where the /tmp directory is located. This issue possibly results in a denial of service.
32+
33+
link:https://access.redhat.com/security/cve/CVE-2024-30205[CVE-2024-30205]::
34+
A flaw was found in Emacs. Org mode considers the content of remote files, such as files opened with TRAMP on remote systems, to be trusted, resulting in arbitrary code execution.
35+
36+
link:https://access.redhat.com/security/cve/CVE-2024-42283[CVE-2024-42283]::
37+
In the Linux kernel, the following vulnerability has been resolved:
38+
net: nexthop: Initialize all fields in dumped nexthops
39+
40+
link:https://access.redhat.com/security/cve/CVE-2024-45005[CVE-2024-45005]::
41+
In the Linux kernel, the following vulnerability has been resolved:
42+
KVM: s390: fix validity interception issue when gisa is switched off
43+
44+
link:https://access.redhat.com/security/cve/CVE-2024-46824[CVE-2024-46824]::
45+
In the Linux kernel, the following vulnerability has been resolved:
46+
iommufd: Require drivers to supply the cache_invalidate_user ops
47+
48+
link:https://access.redhat.com/security/cve/CVE-2024-46858[CVE-2024-46858]::
49+
In the Linux kernel, the following vulnerability has been resolved:
50+
mptcp: pm: Fix uaf in __timer_delete_sync
51+
52+
link:https://access.redhat.com/security/cve/CVE-2024-50602[CVE-2024-50602]::
53+
A security issue was found in Expat (libexpat). A crash can be triggered in the XML_ResumeParser function due to XML_StopParser's ability to stop or suspend an unstarted parser, which can lead to a denial of service.

0 commit comments

Comments
 (0)